mirror of
https://github.com/Telecominfraproject/wlan-ap.git
synced 2025-10-29 17:42:41 +00:00
f1a56edd09
This backports more fixes for the Bluetooth subsystem from 4.9. They were found missing during some initial Bluetooth LE testing. Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
53 lines
2.2 KiB
Diff
53 lines
2.2 KiB
Diff
From 433c3febcb837cf8f2758660c6a89e1d734c55dc Mon Sep 17 00:00:00 2001
|
|
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
|
|
Date: Wed, 28 Jul 2021 15:51:04 +0800
|
|
Subject: [PATCH] Bluetooth: skip invalid hci_sync_conn_complete_evt
|
|
|
|
[ Upstream commit 92fe24a7db751b80925214ede43f8d2be792ea7b ]
|
|
|
|
Syzbot reported a corrupted list in kobject_add_internal [1]. This
|
|
happens when multiple HCI_EV_SYNC_CONN_COMPLETE event packets with
|
|
status 0 are sent for the same HCI connection. This causes us to
|
|
register the device more than once which corrupts the kset list.
|
|
|
|
As this is forbidden behavior, we add a check for whether we're
|
|
trying to process the same HCI_EV_SYNC_CONN_COMPLETE event multiple
|
|
times for one connection. If that's the case, the event is invalid, so
|
|
we report an error that the device is misbehaving, and ignore the
|
|
packet.
|
|
|
|
Link: https://syzkaller.appspot.com/bug?extid=66264bf2fd0476be7e6c [1]
|
|
Reported-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
|
|
Tested-by: syzbot+66264bf2fd0476be7e6c@syzkaller.appspotmail.com
|
|
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
|
|
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
|
|
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
|
---
|
|
net/bluetooth/hci_event.c | 15 +++++++++++++++
|
|
1 file changed, 15 insertions(+)
|
|
|
|
--- a/net/bluetooth/hci_event.c
|
|
+++ b/net/bluetooth/hci_event.c
|
|
@@ -3748,6 +3748,21 @@ static void hci_sync_conn_complete_evt(s
|
|
|
|
switch (ev->status) {
|
|
case 0x00:
|
|
+ /* The synchronous connection complete event should only be
|
|
+ * sent once per new connection. Receiving a successful
|
|
+ * complete event when the connection status is already
|
|
+ * BT_CONNECTED means that the device is misbehaving and sent
|
|
+ * multiple complete event packets for the same new connection.
|
|
+ *
|
|
+ * Registering the device more than once can corrupt kernel
|
|
+ * memory, hence upon detecting this invalid event, we report
|
|
+ * an error and ignore the packet.
|
|
+ */
|
|
+ if (conn->state == BT_CONNECTED) {
|
|
+ bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
|
|
+ goto unlock;
|
|
+ }
|
|
+
|
|
conn->handle = __le16_to_cpu(ev->handle);
|
|
conn->state = BT_CONNECTED;
|
|
conn->type = ev->link_type;
|