[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 333b4fd11e89b29c84c269123f871883a30be586
WARNING: Author mismatch between patch and upstream commit:
Backport author: d.privalov <d.privalov@xxxxxx>
Commit author: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.6.y | Present (different SHA1: b90907696c30)
6.1.y | Present (different SHA1: b22346eec479)
5.15.y | Present (different SHA1: 686e05c9dbd6)
5.10.y | Not found
Note: The patch differs from the upstream commit:
---
1: 333b4fd11e89 ! 1: b709013bb07e Bluetooth: L2CAP: Fix uaf in l2cap_connect
@@ Metadata
## Commit message ##
Bluetooth: L2CAP: Fix uaf in l2cap_connect
+ commit 333b4fd11e89b29c84c269123f871883a30be586 upstream.
+
[Syzbot reported]
BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949
Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54
@@ Commit message
Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c
Fixes: 7b064edae38d ("Bluetooth: Fix authentication if acl data comes before remote feature evt")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
+ Signed-off-by: Dmitriy Privalov <d.privalov@xxxxxx>
## net/bluetooth/hci_core.c ##
@@ net/bluetooth/hci_core.c: static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
@@ net/bluetooth/hci_core.c: static void hci_acldata_packet(struct hci_dev *hdev, s
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_handle(hdev, handle);
+ if (conn && hci_dev_test_flag(hdev, HCI_MGMT))
-+ mgmt_device_connected(hdev, conn, NULL, 0);
++ mgmt_device_connected(hdev, conn, 0, NULL, 0);
hci_dev_unlock(hdev);
if (conn) {
## net/bluetooth/hci_event.c ##
-@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
+@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *hdev,
goto unlock;
}
@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *h
bacpy(&cp.bdaddr, &conn->dst);
## net/bluetooth/l2cap_core.c ##
-@@ net/bluetooth/l2cap_core.c: static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
+@@ net/bluetooth/l2cap_core.c: static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
static int l2cap_connect_req(struct l2cap_conn *conn,
struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
{
@@ net/bluetooth/l2cap_core.c: static void l2cap_connect(struct l2cap_conn *conn, s
return -EPROTO;
- hci_dev_lock(hdev);
-- if (hci_dev_test_flag(hdev, HCI_MGMT))
-- mgmt_device_connected(hdev, hcon, NULL, 0);
+- if (hci_dev_test_flag(hdev, HCI_MGMT) &&
+- !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
+- mgmt_device_connected(hdev, hcon, 0, NULL, 0);
- hci_dev_unlock(hdev);
-
- l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP);
+ l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
return 0;
}
---
Results of testing on various branches:
| Branch | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y | Success | Success |
