AZL-93665

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix UAF of hciconnparams in adddevicecomplete

adddevicecomplete() runs from the hcicmdsyncwork kworker, which holds only hcireqsynclock and not hcidevlock. It calls hciconnparamslookup() and then dereferences the returned object (params->flags) without taking hcidev_lock:

params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr,
                le_addr_type(cp->addr.type));
...
device_flags_changed(NULL, hdev, &cp->addr.bdaddr,
             cp->addr.type, hdev->conn_flags,
             params ? params->flags : 0);

hciconnparamslookup() walks hdev->leconnparams and is documented to require hdev->lock. A concurrent MGMTOPREMOVEDEVICE (removedevice()), which does run under hcidevlock, can call hciconnparamsfree() to list_del() and kfree() the very object the lookup returned, so the subsequent params->flags read touches freed memory [0].

Hold hcidevlock() across the hciconnparamslookup() and the read of params->flags (and the matching event emission) so the lookup result cannot be freed by a concurrent removedevice() before it is used, honouring the locking contract of hciconnparams_lookup().

BUG: KASAN: slab-use-after-free in adddevicecomplete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 Read of size 1 at addr ffff000017ab26c1 by task kworker/u9:8/388

CPU: 1 UID: 0 PID: 388 Comm: kworker/u9:8 Not tainted 7.0.11 #20 PREEMPT Hardware name: linux,dummy-virt (DT) Workqueue: hci0 hcicmdsyncwork Call trace: showstack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dumpstack lib/dumpstack.c:94 [inline] dump_stacklvl+0xb4/0xd4 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0x118/0x5d8 mm/kasan/report.c:482 kasanreport+0xb0/0xf4 mm/kasan/report.c:595 _asanreportload1noabort+0x20/0x2c mm/kasan/reportgeneric.c:378 adddevicecomplete+0x358/0x3d8 net/bluetooth/mgmt.c:7671 hcicmdsyncwork+0x14c/0x240 net/bluetooth/hcisync.c:334 processonework+0x628/0xd38 kernel/workqueue.c:3289 processscheduledworks kernel/workqueue.c:3372 [inline] workerthread+0x7a8/0xac0 kernel/workqueue.c:3453 kthread+0x39c/0x444 kernel/kthread.c:436 retfromfork+0x10/0x20 arch/arm64/kernel/entry.S:860

Allocated by task 3401: kasansavestack+0x3c/0x64 mm/kasan/common.c:57 kasansavetrack+0x20/0x3c mm/kasan/common.c:78 kasansaveallocinfo+0x40/0x54 mm/kasan/generic.c:570 poisonkmalloc_redzone mm/kasan/common.c:398 [inline] __kasankmalloc+0xd4/0xd8 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 [inline] __kmalloccachenoprof+0x1b0/0x458 mm/slub.c:5385 kmallocnoprof include/linux/slab.h:950 [inline] kzallocnoprof include/linux/slab.h:1188 [inline] hciconnparamsadd+0x10c/0x4b0 net/bluetooth/hcicore.c:2279 hciconnparamsset net/bluetooth/mgmt.c:5162 [inline] adddevice+0x5b4/0xa54 net/bluetooth/mgmt.c:7755 hcimgmtcmd net/bluetooth/hcisock.c:1721 [inline] hcisocksendmsg+0x10b4/0x1dd0 net/bluetooth/hcisock.c:1841 socksendmsgnosec net/socket.c:727 [inline] __socksendmsg+0xe0/0x128 net/socket.c:742 sockwriteiter+0x250/0x390 net/socket.c:1195 newsyncwrite fs/readwrite.c:595 [inline] vfswrite+0x66c/0xab0 fs/readwrite.c:688 ksyswrite+0x1fc/0x24c fs/readwrite.c:740 __dosyswrite fs/read_write.c:751 [inline] __sesyswrite fs/read_write.c:748 [inline] __arm64syswrite+0x70/0xa4 fs/read_write.c:748 __invokesyscall arch/arm64/kernel/syscall.c:35 [inline] invokesyscall+0x84/0x2a8 arch/arm64/kernel/syscall.c:49 el0svccommon.constprop.0+0xe4/0x294 arch/arm64/kernel/syscall.c:132 doel0svc+0x44/0x5c arch/arm64/kernel/syscall.c:151 el0svc+0x38/0xac arch/arm64/kernel/entry-common.c:724 el0t64synchandler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:743 el0t64sync+0x198/0x19c arch/arm64/kernel/entry.S:596

Freed by task 3740: kasansavestack+0x3c/0x64 ---truncated---