lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.13 077/219] Bluetooth: skip invalid hci_sync_conn_complete_evt
    Date
    From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>

    [ Upstream commit 92fe24a7db751b80925214ede43f8d2be792ea7b ]

    Syzbot reported a corrupted list in kobject_add_internal [1]. This
    happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with
    status 0 are sent for the same HCI connection. This causes us to
    register the device more than once which corrupts the kset list.

    As this is forbidden behavior, we add a check for whether we're
    trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple
    times for one connection. If that's the case, the event is invalid, so
    we report an error that the device is misbehaving, and ignore the
    packet.

    Link: https://syzkaller.appspot.com/bug?extid=66264bf2fd0476be7e6c [1]
    Reported-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
    Tested-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
    Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/hci_event.c | 15 +++++++++++++++
    1 file changed, 15 insertions(+)

    diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    index 62c99e015609..c5de24372971 100644
    --- a/net/bluetooth/hci_event.c
    +++ b/net/bluetooth/hci_event.c
    @@ -4373,6 +4373,21 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,

    switch (ev->status) {
    case 0x00:
    + /* The synchronous connection complete event should only be
    + * sent once per new connection. Receiving a successful
    + * complete event when the connection status is already
    + * BT_CONNECTED means that the device is misbehaving and sent
    + * multiple complete event packets for the same new connection.
    + *
    + * Registering the device more than once can corrupt kernel
    + * memory, hence upon detecting this invalid event, we report
    + * an error and ignore the packet.
    + */
    + if (conn->state == BT_CONNECTED) {
    + bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
    + goto unlock;
    + }
    +
    conn->handle = __le16_to_cpu(ev->handle);
    conn->state = BT_CONNECTED;
    conn->type = ev->link_type;
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-09 14:37    [W:4.074 / U:0.396 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site