Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)
From: Hillf Danton
Date: Wed Sep 11 2024 - 07:30:29 EST
On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000
#syz test
--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);
if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc
/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_conn_put(conn);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co
mutex_unlock(&conn->chan_lock);
- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);
hcon->l2cap_data = NULL;
- conn->hchan = NULL;
l2cap_conn_put(conn);
}
@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
{
struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
+ hci_chan_del(conn->hchan);
hci_conn_put(conn->hcon);
kfree(conn);
}
@@ -4073,11 +4071,15 @@ static int l2cap_connect_req(struct l2ca
return -EPROTO;
hci_dev_lock(hdev);
+ if (hcon->state == BT_CLOSED) {
+ hci_dev_unlock(hdev);
+ return -EPROTO;
+ }
if (hci_dev_test_flag(hdev, HCI_MGMT))
mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);
l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
+ hci_dev_unlock(hdev);
return 0;
}
@@ -7486,6 +7488,14 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;
+ hci_dev_lock(hcon->hdev);
+ if (conn != hcon->l2cap_data)
+ conn = NULL;
+ else
+ l2cap_conn_get(conn);
+ hci_dev_unlock(hcon->hdev);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
switch (flags) {
@@ -7512,6 +7522,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}
@@ -7576,6 +7587,8 @@ void l2cap_recv_acldata(struct hci_conn
drop:
kfree_skb(skb);
+ if (conn)
+ l2cap_conn_put(conn);
}
static struct hci_cb l2cap_cb = {
--