• Sungwoo Kim's avatar
    Bluetooth: msft: fix slab-use-after-free in msft_do_close() · 10f9f426
    Sungwoo Kim authored
    Tying the msft->data lifetime to hdev by freeing it in
    hci_release_dev() to fix the following case:
    
    [use]
    msft_do_close()
      msft = hdev->msft_data;
      if (!msft)                      ...(1) <- passed.
        return;
      mutex_lock(&msft->filter_lock); ...(4) <- used after freed.
    
    [free]
    msft_unregister()
      msft = hdev->msft_data;
      hdev->msft_data = NULL;         ...(2)
      kfree(msft);                    ...(3) <- msft is freed.
    
    ==================================================================
    BUG: KASAN: slab-use-after-free in __mutex_lock_common
    kernel/locking/mutex.c:587 [inline]
    BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30
    kernel/locking/mutex.c:752
    Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309
    
    Fixes: bf6a4e30 ("Bluetooth: disable advertisement filters during suspend")
    Signed-off-by: default avatarSungwoo Kim <iam@sung-woo.kim>
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    10f9f426
hci_core.c 96.4 KB