linux-kernel - Re: #syz test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKZCeSX8iZaSnSTrRKAcuv0e+YNLP+8JA8+6XcbhAxBQ0-QtXg@mail.gmail.com>
Date: Mon, 9 Feb 2026 05:09:46 +0900
From: kawada <youjingxiaogao2@...il.com>
To: syzbot <syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: #syz test

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
master

2026年2月9日(月) 5:03 syzbot <
syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com>:

> > #syz test git://
> git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
> > master
> >
> > From d5153b84b90fa80ee0d041d1bd28bd465f7913ec Mon Sep 17 00:00:00 2001
> > From: Masahiro Kawada <youjingxiaogao2@...il.com>
> > Date: Mon, 9 Feb 2026 04:47:14 +0900
> > Subject: [PATCH] Bluetooth: fix use-after-free in hci_conn_drop
> >
> > Fix a use-after-free in hci_conn_drop triggered via hci_cmd_sync_work.
> >
> > In hci_conn_del(), hci_cmd_sync_dequeue() is called after
> > hci_conn_cleanup() which may have already freed the conn pointer.
> > Fix by moving the dequeue before cleanup.
> >
> > Additionally, le_read_features_complete() calls hci_conn_drop(conn)
> > without checking whether conn is still valid. When
> > hci_le_read_remote_features_sync() blocks waiting for an HCI event,
> > another thread can free conn through hci_conn_del(). Fix by adding
> > a hci_conn_valid() check before calling hci_conn_drop().
> >
> > Reported-by: syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=3609b9b48e68e1fe47fd
> > Signed-off-by: Masahiro Kawada <youjingxiaogao2@...il.com>
> > ---
> >  net/bluetooth/hci_conn.c | 6 +++---
> >  net/bluetooth/hci_sync.c | 3 +++
> >  2 files changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> > index 0795818963a..aa3607327ad 100644
> > --- a/net/bluetooth/hci_conn.c
> > +++ b/net/bluetooth/hci_conn.c
> > @@ -1232,15 +1232,15 @@ void hci_conn_del(struct hci_conn *conn)
> >   skb_queue_purge(&conn->data_q);
> >   skb_queue_purge(&conn->tx_q.queue);
> >
> > + /* Dequeue callbacks using connection pointer as data */
> > + hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
> > +
> >   /* Remove the connection from the list and cleanup its remaining
> >   * state. This is a separate function since for some cases like
> >   * BT_CONNECT_SCAN we *only* want the cleanup part without the
> >   * rest of hci_conn_del.
> >   */
> >   hci_conn_cleanup(conn);
> > -
> > - /* Dequeue callbacks using connection pointer as data */
> > - hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
> >  }
> >
> >  struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t
> > src_type)
> > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> > index f04a90bce4a..f31086c187f 100644
> > --- a/net/bluetooth/hci_sync.c
> > +++ b/net/bluetooth/hci_sync.c
> > @@ -7371,6 +7371,9 @@ static void le_read_features_complete(struct
> hci_dev
> > *hdev, void *data, int err)
> >   if (err == -ECANCELED)
> >   return;
> >
> > + if (!hci_conn_valid(hdev, conn))
> > + return;
> > +
> >   hci_conn_drop(conn);
> >  }
> >
> > --
> > 2.43.0
>
> Command #2:
> I've failed to parse your command.
> Did you perhaps forget to provide the branch name, or added an extra ':'?
> Please use one of the two supported formats:
> 1. #syz test
> 2. #syz test: repo branch-or-commit-hash
> Note the lack of ':' in option 1.
>
>

Content of type "text/html" skipped

Download attachment "0001-Bluetooth-fix-use-after-free-in-hci_conn_drop.patch" of type "application/octet-stream" (2351 bytes)