linux-kernel - Re: #syz test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKZCeSU1Xc1yr+mGYfc62eYTvaV0kYCnKeeHP-5LB2m+fiN1dQ@mail.gmail.com>
Date: Mon, 9 Feb 2026 16:50:03 +0900
From: kawada <youjingxiaogao2@...il.com>
To: syzbot <syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: #syz test

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
 master

2026年2月9日(月) 5:09 kawada <youjingxiaogao2@...il.com>:

> #syz test: git://
> git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
>
> 2026年2月9日(月) 5:03 syzbot <
> syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com>:
>
>> > #syz test git://
>> git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
>> > master
>> >
>> > From d5153b84b90fa80ee0d041d1bd28bd465f7913ec Mon Sep 17 00:00:00 2001
>> > From: Masahiro Kawada <youjingxiaogao2@...il.com>
>> > Date: Mon, 9 Feb 2026 04:47:14 +0900
>> > Subject: [PATCH] Bluetooth: fix use-after-free in hci_conn_drop
>> >
>> > Fix a use-after-free in hci_conn_drop triggered via hci_cmd_sync_work.
>> >
>> > In hci_conn_del(), hci_cmd_sync_dequeue() is called after
>> > hci_conn_cleanup() which may have already freed the conn pointer.
>> > Fix by moving the dequeue before cleanup.
>> >
>> > Additionally, le_read_features_complete() calls hci_conn_drop(conn)
>> > without checking whether conn is still valid. When
>> > hci_le_read_remote_features_sync() blocks waiting for an HCI event,
>> > another thread can free conn through hci_conn_del(). Fix by adding
>> > a hci_conn_valid() check before calling hci_conn_drop().
>> >
>> > Reported-by: syzbot+3609b9b48e68e1fe47fd@...kaller.appspotmail.com
>> > Closes: https://syzkaller.appspot.com/bug?extid=3609b9b48e68e1fe47fd
>> > Signed-off-by: Masahiro Kawada <youjingxiaogao2@...il.com>
>> > ---
>> >  net/bluetooth/hci_conn.c | 6 +++---
>> >  net/bluetooth/hci_sync.c | 3 +++
>> >  2 files changed, 6 insertions(+), 3 deletions(-)
>> >
>> > diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
>> > index 0795818963a..aa3607327ad 100644
>> > --- a/net/bluetooth/hci_conn.c
>> > +++ b/net/bluetooth/hci_conn.c
>> > @@ -1232,15 +1232,15 @@ void hci_conn_del(struct hci_conn *conn)
>> >   skb_queue_purge(&conn->data_q);
>> >   skb_queue_purge(&conn->tx_q.queue);
>> >
>> > + /* Dequeue callbacks using connection pointer as data */
>> > + hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
>> > +
>> >   /* Remove the connection from the list and cleanup its remaining
>> >   * state. This is a separate function since for some cases like
>> >   * BT_CONNECT_SCAN we *only* want the cleanup part without the
>> >   * rest of hci_conn_del.
>> >   */
>> >   hci_conn_cleanup(conn);
>> > -
>> > - /* Dequeue callbacks using connection pointer as data */
>> > - hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);
>> >  }
>> >
>> >  struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t
>> > src_type)
>> > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
>> > index f04a90bce4a..f31086c187f 100644
>> > --- a/net/bluetooth/hci_sync.c
>> > +++ b/net/bluetooth/hci_sync.c
>> > @@ -7371,6 +7371,9 @@ static void le_read_features_complete(struct
>> hci_dev
>> > *hdev, void *data, int err)
>> >   if (err == -ECANCELED)
>> >   return;
>> >
>> > + if (!hci_conn_valid(hdev, conn))
>> > + return;
>> > +
>> >   hci_conn_drop(conn);
>> >  }
>> >
>> > --
>> > 2.43.0
>>
>> Command #2:
>> I've failed to parse your command.
>> Did you perhaps forget to provide the branch name, or added an extra ':'?
>> Please use one of the two supported formats:
>> 1. #syz test
>> 2. #syz test: repo branch-or-commit-hash
>> Note the lack of ':' in option 1.
>>
>>

Content of type "text/html" skipped

Download attachment "0001-Bluetooth-fix-use-after-free-in-hci_conn_drop.patch" of type "application/octet-stream" (2579 bytes)