• Luiz Augusto von Dentz's avatar
    Bluetooth: hci_sync: Fix UAF on create_le_conn_complete · f7cbce60
    Luiz Augusto von Dentz authored
    While waiting for hci_dev_lock the hci_conn object may be cleanup
    causing the following trace:
    
    BUG: KASAN: slab-use-after-free in hci_connect_le_scan_cleanup+0x29/0x350
    Read of size 8 at addr ffff888001a50a30 by task kworker/u3:1/111
    
    CPU: 0 PID: 111 Comm: kworker/u3:1 Not tainted
    6.8.0-rc2-00701-g8179b15ab3fd-dirty #6418
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38
    04/01/2014
    Workqueue: hci0 hci_cmd_sync_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x21/0x70
     print_report+0xce/0x620
     ? preempt_count_sub+0x13/0xc0
     ? __virt_addr_valid+0x15f/0x310
     ? hci_connect_le_scan_cleanup+0x29/0x350
     kasan_report+0xdf/0x110
     ? hci_connect_le_scan_cleanup+0x29/0x350
     hci_connect_le_scan_cleanup+0x29/0x350
     create_le_conn_complete+0x25c/0x2c0
    
    Fixes: 881559af ("Bluetooth: hci_sync: Attempt to dequeue connection attempt")
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    f7cbce60
hci_sync.c 174 KB