This is a note to let you know that I've just added the patch titled
Bluetooth: Fix potential double free caused by hci_conn_unlink
to the 6.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bluetooth-fix-potential-double-free-caused-by-hci_conn_unlink.patch
and it can be found in the queue-6.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f Mon Sep 17 00:00:00 2001
From: Ruihan Li <lrh2000@xxxxxxxxxx>
Date: Wed, 3 May 2023 21:39:34 +0800
Subject: Bluetooth: Fix potential double free caused by hci_conn_unlink
From: Ruihan Li <lrh2000@xxxxxxxxxx>
commit ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f upstream.
The hci_conn_unlink function is being called by hci_conn_del, which
means it should not call hci_conn_del with the input parameter conn
again. If it does, conn may have already been released when
hci_conn_unlink returns, leading to potential UAF and double-free
issues.
This patch resolves the problem by modifying hci_conn_unlink to release
only conn's child links when necessary, but never release conn itself.
Reported-by: syzbot+690b90b14f14f43f4688@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://lore.kernel.org/linux-bluetooth/000000000000484a8205faafe216@xxxxxxxxxx/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <lrh2000@xxxxxxxxxx>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Reported-by: syzbot+690b90b14f14f43f4688@xxxxxxxxxxxxxxxxxxxxxxxxx
Reported-by: Luiz Augusto von Dentz <luiz.dentz@xxxxxxxxx>
Reported-by: syzbot+8bb72f86fc823817bc5d@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/bluetooth/hci_conn.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1088,8 +1088,18 @@ static void hci_conn_unlink(struct hci_c
if (!conn->parent) {
struct hci_link *link, *t;
- list_for_each_entry_safe(link, t, &conn->link_list, list)
- hci_conn_unlink(link->conn);
+ list_for_each_entry_safe(link, t, &conn->link_list, list) {
+ struct hci_conn *child = link->conn;
+
+ hci_conn_unlink(child);
+
+ /* Due to race, SCO connection might be not established
+ * yet at this point. Delete it now, otherwise it is
+ * possible for it to be stuck and can't be deleted.
+ */
+ if (child->handle == HCI_CONN_HANDLE_UNSET)
+ hci_conn_del(child);
+ }
return;
}
@@ -1105,13 +1115,6 @@ static void hci_conn_unlink(struct hci_c
kfree(conn->link);
conn->link = NULL;
-
- /* Due to race, SCO connection might be not established
- * yet at this point. Delete it now, otherwise it is
- * possible for it to be stuck and can't be deleted.
- */
- if (conn->handle == HCI_CONN_HANDLE_UNSET)
- hci_conn_del(conn);
}
int hci_conn_del(struct hci_conn *conn)
Patches currently in stable-queue which might be from lrh2000@xxxxxxxxxx are
queue-6.3/bluetooth-refcnt-drop-must-be-placed-last-in-hci_conn_unlink.patch
queue-6.3/bluetooth-fix-potential-double-free-caused-by-hci_conn_unlink.patch
queue-6.3/usb-usbfs-enforce-page-requirements-for-mmap.patch
queue-6.3/mm-page_table_check-make-it-dependent-on-exclusive_system_ram.patch
queue-6.3/bluetooth-fix-uaf-in-hci_conn_hash_flush-again.patch
queue-6.3/usb-usbfs-use-consistent-mmap-functions.patch
queue-6.3/mm-page_table_check-ensure-user-pages-are-not-slab-pages.patch
