• Luiz Augusto von Dentz's avatar
    Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync · 7453847f
    Luiz Augusto von Dentz authored
    Fixes the following trace where hci_acl_create_conn_sync attempts to
    call hci_abort_conn_sync after timeout:
    
    BUG: KASAN: slab-use-after-free in hci_abort_conn_sync
    (net/bluetooth/hci_sync.c:5439)
    Read of size 2 at addr ffff88800322c032 by task kworker/u3:2/36
    
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38
    04/01/2014
    Workqueue: hci0 hci_cmd_sync_work
    Call Trace:
    <TASK>
    dump_stack_lvl (./arch/x86/include/asm/irqflags.h:26
    ./arch/x86/include/asm/irqflags.h:67 ./arch/x86/include/asm/irqflags.h:127
    lib/dump_stack.c:107)
    print_report (mm/kasan/report.c:378 mm/kasan/report.c:488)
    ? preempt_count_sub (kernel/sched/core.c:5889)
    ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:103 (discriminator 1)
    ./include/linux/rcupdate.h:865 (discriminator 1)
    ./include/linux/mmzone.h:2026 (discriminator 1)
    arch/x86/mm/physaddr.c:65 (discriminator 1))
    ? hci_abort_conn_sync (net/bluetooth/hci_sync.c:5439)
    kasan_report (mm/kasan/report.c:603)
    ? hci_abort_conn_sync (net/bluetooth/hci_sync.c:5439)
    hci_abort_conn_sync (net/bluetooth/hci_sync.c:5439)
    ? __pfx_hci_abort_conn_sync (net/bluetooth/hci_sync.c:5433)
    hci_acl_create_conn_sync (net/bluetooth/hci_sync.c:6681)
    
    Fixes: 45340097 ("Bluetooth: hci_conn: Only do ACL connections sequentially")
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    7453847f
hci_sync.c 174 KB