]> git.dujemihanovic.xyz Git - linux.git/commit
Bluetooth: msft: fix slab-use-after-free in msft_do_close()
authorSungwoo Kim <iam@sung-woo.kim>
Tue, 30 Apr 2024 16:20:51 +0000 (12:20 -0400)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Fri, 3 May 2024 17:05:28 +0000 (13:05 -0400)
commit10f9f426ac6e752c8d87bf4346930ba347aaabac
tree8b5614014538497085d6e8b4d8eb1bb31dd28085
parent4d7b41c0e43995b0e992b9f8903109275744b658
Bluetooth: msft: fix slab-use-after-free in msft_do_close()

Tying the msft->data lifetime to hdev by freeing it in
hci_release_dev() to fix the following case:

[use]
msft_do_close()
  msft = hdev->msft_data;
  if (!msft)                      ...(1) <- passed.
    return;
  mutex_lock(&msft->filter_lock); ...(4) <- used after freed.

[free]
msft_unregister()
  msft = hdev->msft_data;
  hdev->msft_data = NULL;         ...(2)
  kfree(msft);                    ...(3) <- msft is freed.

==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common
kernel/locking/mutex.c:587 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30
kernel/locking/mutex.c:752
Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309

Fixes: bf6a4e30ffbd ("Bluetooth: disable advertisement filters during suspend")
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_core.c
net/bluetooth/msft.c
net/bluetooth/msft.h