Patch "Bluetooth: skip invalid hci_sync_conn_complete_evt" has been added to the 4.19-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: skip invalid hci_sync_conn_complete_evt

to the 4.19-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-skip-invalid-hci_sync_conn_complete_evt.patch
and it can be found in the queue-4.19 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4bc179fd8b0b1b04de7359879c1002fc5e2c63b3
Author: Desmond Cheong Zhi Xi <desmondcheongzx@xxxxxxxxx>
Date:   Wed Jul 28 15:51:04 2021 +0800

    Bluetooth: skip invalid hci_sync_conn_complete_evt
    
    [ Upstream commit 92fe24a7db751b80925214ede43f8d2be792ea7b ]
    
    Syzbot reported a corrupted list in kobject_add_internal [1]. This
    happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with
    status 0 are sent for the same HCI connection. This causes us to
    register the device more than once which corrupts the kset list.
    
    As this is forbidden behavior, we add a check for whether we're
    trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple
    times for one connection. If that's the case, the event is invalid, so
    we report an error that the device is misbehaving, and ignore the
    packet.
    
    Link: https://syzkaller.appspot.com/bug?extid=66264bf2fd0476be7e6c [1]
    Reported-by: syzbot+66264bf2fd0476be7e6c@xxxxxxxxxxxxxxxxxxxxxxxxx
    Tested-by: syzbot+66264bf2fd0476be7e6c@xxxxxxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@xxxxxxxxx>
    Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 45cc864cf2b3..714a45355610 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4083,6 +4083,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
 
 	switch (ev->status) {
 	case 0x00:
+		/* The synchronous connection complete event should only be
+		 * sent once per new connection. Receiving a successful
+		 * complete event when the connection status is already
+		 * BT_CONNECTED means that the device is misbehaving and sent
+		 * multiple complete event packets for the same new connection.
+		 *
+		 * Registering the device more than once can corrupt kernel
+		 * memory, hence upon detecting this invalid event, we report
+		 * an error and ignore the packet.
+		 */
+		if (conn->state == BT_CONNECTED) {
+			bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
+			goto unlock;
+		}
+
 		conn->handle = __le16_to_cpu(ev->handle);
 		conn->state  = BT_CONNECTED;
 		conn->type   = ev->link_type;