• Luiz Augusto von Dentz's avatar
    Bluetooth: hci_conn: Fix possible UAF · 5dc7d23e
    Luiz Augusto von Dentz authored
    This fixes the following trace:
    
    ==================================================================
    BUG: KASAN: slab-use-after-free in hci_conn_del+0xba/0x3a0
    Write of size 8 at addr ffff88800208e9c8 by task iso-tester/31
    
    CPU: 0 PID: 31 Comm: iso-tester Not tainted 6.3.0-rc2-g991aa4a69a47
     #4716
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc36
    04/01/2014
    Call Trace:
     <TASK>
     dump_stack_lvl+0x1d/0x70
     print_report+0xce/0x610
     ? __virt_addr_valid+0xd4/0x150
     ? hci_conn_del+0xba/0x3a0
     kasan_report+0xdd/0x110
     ? hci_conn_del+0xba/0x3a0
     hci_conn_del+0xba/0x3a0
     hci_conn_hash_flush+0xf2/0x120
     hci_dev_close_sync+0x388/0x920
     hci_unregister_dev+0x122/0x260
     vhci_release+0x4f/0x90
     __fput+0x102/0x430
     task_work_run+0xf1/0x160
     ? __pfx_task_work_run+0x10/0x10
     ? mark_held_locks+0x24/0x90
     exit_to_user_mode_prepare+0x170/0x180
     syscall_exit_to_user_mode+0x19/0x50
     do_syscall_64+0x4e/0x90
     entry_SYSCALL_64_after_hwframe+0x70/0xda
    
    Fixes: 0f00cd32 ("Bluetooth: Free potentially unfreed SCO connection")
    Link: https://syzkaller.appspot.com/bug?extid=8bb72f86fc823817bc5d
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    5dc7d23e
hci_conn.c 69.6 KB