Hi Luiz,
I apologize for sending too many emails and causing any inconvenience.
However, I forgot to add the CC List in the previous email, and there
was something wrong with the version change description in the
previously submitted V2 patch. Therefore, I have now submitted the patch
again. I sincerely apologize for any inconvenience caused.
I have attempted to fix this bug using the method you described in your
response. After our testing, we have confirmed that this method is
effective, and now the KASAN will not be triggered. I have submitted a
new version of the patch.
https://patchwork.kernel.org/project/bluetooth/patch/20240103040611.3279681-1-20373622@xxxxxxxxxxx/
Thank you once again, and I sincerely look forward to your response.
On 2024/1/3 1:02, Luiz Augusto von Dentz wrote:
Hi Yuxuan,
On Tue, Dec 26, 2023 at 2:40 AM Yuxuan Hu <20373622@xxxxxxxxxxx> wrote:
During our fuzz testing of the connection and disconnection process at the
RFCOMM layer,we discovered this bug.By comparing the packetsfrom a normal
connection and disconnection process with the testcase that triggered a
KASAN report, we analyzed the cause of this bug as follows:
1. In the packets captured during a normal connection, the host sends a
`Read Encryption Key Size` type of `HCI_CMD` packet(Command Opcode: 0x1408)
to the controller to inquire the length of encryption key.After receiving
this packet, the controller immediately replies with a Command Complete
packet (Event Code: 0x0e) to return the Encryption Key Size.
2. In our fuzz test case, the timing of the controller's response to this
packet was delayed to an unexpected point: after the RFCOMM and L2CAP
layers had disconnected but before the HCI layer had disconnected.
3. After receiving the Encryption Key Size Response at the time described
in point 2, the host still called the rfcomm_check_security function.
However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;`
had already been released, and when the function executed
`return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`,
specifically when accessing `conn->hcon`, a null-ptr-deref error occurred.
Adding a check for whether `conn` is a null pointer to fix this bug.
Signed-off-by: Yuxuan Hu <20373622@xxxxxxxxxxx>
---
net/bluetooth/rfcomm/core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 053ef8f25fae..5ffa197fdb48 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -228,6 +228,9 @@ static int rfcomm_check_security(struct rfcomm_dlc *d)
auth_type = HCI_AT_NO_BONDING;
break;
}
+
+ if (!conn)
+ return 0;
This shall probably be handled earlier, perhaps on rfcomm_process_rx
if we can check that had been disconnected, that way we drop packets
that we know don't have any effect since later we do call
rfcomm_session_close e.g:
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 053ef8f25fae..1d34d8497033 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -1941,7 +1941,7 @@ static struct rfcomm_session
*rfcomm_process_rx(struct rfcomm_session *s)
/* Get data directly from socket receive queue without copying it. */
while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
skb_orphan(skb);
- if (!skb_linearize(skb)) {
+ if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) {
s = rfcomm_recv_frame(s, skb);
if (!s)
break;
