]> git.itanic.dy.fi Git - linux-stable/commit
Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
authorDouglas Anderson <dianders@chromium.org>
Fri, 30 Jun 2023 22:33:14 +0000 (15:33 -0700)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Thu, 20 Jul 2023 18:25:50 +0000 (11:25 -0700)
commitde6dfcefd107667ce2dbedf4d9337f5ed557a4a1
tree4a2d8d85580a4b1b9015a5cf83c32a148ebebab6
parent6910e2eb39254d279bce5bc0f8eb6af45b59357c
Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()

KASAN reports that there's a use-after-free in
hci_remove_adv_monitor(). Trawling through the disassembly, you can
see that the complaint is from the access in bt_dev_dbg() under the
HCI_ADV_MONITOR_EXT_MSFT case. The problem case happens because
msft_remove_monitor() can end up freeing the monitor
structure. Specifically:
  hci_remove_adv_monitor() ->
  msft_remove_monitor() ->
  msft_remove_monitor_sync() ->
  msft_le_cancel_monitor_advertisement_cb() ->
  hci_free_adv_monitor()

Let's fix the problem by just stashing the relevant data when it's
still valid.

Fixes: 7cf5c2978f23 ("Bluetooth: hci_sync: Refactor remove Adv Monitor")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_core.c