[PATCH] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

[PATCH] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

[Palla Raghunath]

syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an
RFCOMM tty is closed.

rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only
then registers the tty device and saves it in dev->tty_dev. If that
registration fails, dev->tty_dev is never set at all. The device can be
looked up in the meantime, so an open() of /dev/rfcommN gets through
rfcomm_tty_install() and attaches to it. When that tty is closed again,
rfcomm_dev_shutdown() uses dev->tty_dev without checking it:

  Oops: general protection fault, probably for non-canonical address
  KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
  RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131
  Call Trace:
   tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372
   tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705
   tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718
   __fput+0x418/0xa50 fs/file_table.c:512

rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the
same check to rfcomm_dev_shutdown(), so the tty device is only moved
when it was actually registered.

Fixes: cad348a17e17 ("Bluetooth: Implement .activate, .shutdown and .carrier_raised methods")
Reported-by: syzbot+4a807caf7680652d53b6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4a807caf7680652d53b6
Cc: stable@vger.kernel.org
Signed-off-by: Palla Raghunath <raghunathpalla.0209@gmail.com>
---
I reproduced this on next-20261001 with a small program that creates and
releases rfcomm0 in a loop while two other threads keep opening and
closing /dev/rfcomm0, with a vhci controller up so the open gets as far
as rfcomm_dev_activate(). It crashed within about ten seconds every time.
With this patch applied it ran for five minutes without any problems.

 net/bluetooth/rfcomm/tty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index dc3cdf614def..198c7dd1a95b 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -128,7 +128,7 @@ static void rfcomm_dev_shutdown(struct tty_port *port)
 {
 	struct rfcomm_dev *dev = container_of(port, struct rfcomm_dev, port);
 
-	if (dev->tty_dev->parent)
+	if (dev->tty_dev && dev->tty_dev->parent)
 		device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 
 	/* close the dlc */
-- 
2.34.1

RE: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1072 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1178103/

---Test result---

Test Summary:
CheckPatch                    PASS      0.54 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.51 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      23.64 seconds
CheckAllWarning               PASS      25.57 seconds
CheckSparse                   PASS      27.64 seconds
BuildKernel32                 PASS      22.80 seconds
CheckKernelLLVM               PASS      24.21 seconds
TestRunnerSetup               PASS      582.62 seconds
TestRunner_rfcomm-tester      PASS      6.96 seconds
IncrementalBuild              PASS      21.90 seconds



https://github.com/bluez/bluetooth-next/pull/851

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri,  2 Oct 2026 08:07:52 +0100 you wrote:
> syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an
> RFCOMM tty is closed.
> 
> rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only
> then registers the tty device and saves it in dev->tty_dev. If that
> registration fails, dev->tty_dev is never set at all. The device can be
> looked up in the meantime, so an open() of /dev/rfcommN gets through
> rfcomm_tty_install() and attaches to it. When that tty is closed again,
> rfcomm_dev_shutdown() uses dev->tty_dev without checking it:
> 
> [...]

Here is the summary with links:
  - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
    https://git.kernel.org/bluetooth/bluetooth-next/c/08e90633377f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html