Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)

From: Hillf Danton
Date: Wed Sep 11 2024 - 07:30:29 EST


On Sat, 07 Sep 2024 07:42:26 -0700
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 788220eee30d Merge tag 'pm-6.11-rc7' of git://git.kernel.o..
> git tree: upstream
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1304189f980000

#syz test

--- x/net/bluetooth/hci_core.c
+++ y/net/bluetooth/hci_core.c
@@ -3782,6 +3782,8 @@ static void hci_acldata_packet(struct hc

hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn)
+ hci_conn_get(conn);
hci_dev_unlock(hdev);

if (conn) {
@@ -3789,6 +3791,7 @@ static void hci_acldata_packet(struct hc

/* Send to upper protocol */
l2cap_recv_acldata(conn, skb, flags);
+ hci_conn_put(conn);
return;
} else {
bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -1792,13 +1792,10 @@ static void l2cap_conn_del(struct hci_co

mutex_unlock(&conn->chan_lock);

- hci_chan_del(conn->hchan);
-
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
cancel_delayed_work_sync(&conn->info_timer);

hcon->l2cap_data = NULL;
- conn->hchan = NULL;
l2cap_conn_put(conn);
}

@@ -1806,6 +1803,7 @@ static void l2cap_conn_free(struct kref
{
struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);

+ hci_chan_del(conn->hchan);
hci_conn_put(conn->hcon);
kfree(conn);
}
@@ -4073,11 +4071,15 @@ static int l2cap_connect_req(struct l2ca
return -EPROTO;

hci_dev_lock(hdev);
+ if (hcon->state == BT_CLOSED) {
+ hci_dev_unlock(hdev);
+ return -EPROTO;
+ }
if (hci_dev_test_flag(hdev, HCI_MGMT))
mgmt_device_connected(hdev, hcon, NULL, 0);
- hci_dev_unlock(hdev);

l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
+ hci_dev_unlock(hdev);
return 0;
}

@@ -7486,6 +7488,14 @@ void l2cap_recv_acldata(struct hci_conn
if (!conn)
goto drop;

+ hci_dev_lock(hcon->hdev);
+ if (conn != hcon->l2cap_data)
+ conn = NULL;
+ else
+ l2cap_conn_get(conn);
+ hci_dev_unlock(hcon->hdev);
+ if (!conn)
+ goto drop;
BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);

switch (flags) {
@@ -7512,6 +7522,7 @@ void l2cap_recv_acldata(struct hci_conn
if (len == skb->len) {
/* Complete frame received */
l2cap_recv_frame(conn, skb);
+ l2cap_conn_put(conn);
return;
}

@@ -7576,6 +7587,8 @@ void l2cap_recv_acldata(struct hci_conn

drop:
kfree_skb(skb);
+ if (conn)
+ l2cap_conn_put(conn);
}

static struct hci_cb l2cap_cb = {
--