[PATCH] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[PATCH] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[Hui Peng]

The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not
connected as long as deferred setup is enabled:

	if (sk->sk_state != BT_CONNECTED &&
				!rfcomm_pi(sk)->dlc->defer_setup) {
		err = -ENOTCONN;
		break;
	}
	l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;

BT_DEFER_SETUP can be set on a listening socket, and it is stored in
rfcomm_pi(sk)->dlc->defer_setup while dlc->session is still NULL. A
local user can therefore create an RFCOMM socket, call listen(), set
BT_DEFER_SETUP, and then call getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO)
to skip the -ENOTCONN path and dereference the NULL session:

 Oops: general protection fault, probably for non-canonical address
 0xdffffc0000000002
 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
 CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9 #1
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780
 Call Trace:
  <TASK>
  do_sock_getsockopt+0x3ad/0x7d0
  __sys_getsockopt+0x10e/0x1b0
  __x64_sys_getsockopt+0xc2/0x160
  do_syscall_64+0xda/0x4b0
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

Deferred setup only leaves a socket usable here once it has reached
BT_CONNECT2, so restrict the exception to that state and check that a
session is actually present before following it.

Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
No Fixes: tag: I could not pin the change that introduced this with
confidence, so I left it out rather than guess.

Reproduced on Linux 7.3.0-rc3 (5dd1818b15d9) with KASAN under QEMU with
a virtual HCI device:

  s = socket(AF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM);
  bind(s, ...); listen(s, 1);
  setsockopt(s, SOL_BLUETOOTH, BT_DEFER_SETUP, &one, 4);
  getsockopt(s, SOL_RFCOMM, RFCOMM_CONNINFO, &ci, &len);   /* boom */

With this patch the getsockopt() returns -ENOTCONN instead.

 net/bluetooth/rfcomm/sock.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -786,8 +786,10 @@ static int rfcomm_sock_getsockopt_old(st
 		break;
 
 	case RFCOMM_CONNINFO:
-		if (sk->sk_state != BT_CONNECTED &&
-					!rfcomm_pi(sk)->dlc->defer_setup) {
+		if ((sk->sk_state != BT_CONNECTED &&
+		     !(sk->sk_state == BT_CONNECT2 &&
+		       rfcomm_pi(sk)->dlc->defer_setup)) ||
+		    !rfcomm_pi(sk)->dlc->session) {
 			err = -ENOTCONN;
 			break;
 		}
-- 
2.43.0

[PATCH v2] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[Hui Peng]

The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not
connected as long as deferred setup is enabled:

	if (sk->sk_state != BT_CONNECTED &&
				!rfcomm_pi(sk)->dlc->defer_setup) {
		err = -ENOTCONN;
		break;
	}
	l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;

dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind()
creates a child socket for an incoming connection on a listening socket
that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The
session, however, can go away underneath it.

rfcomm_recv_disc() forces the dlc state before tearing it down:

	d->state = BT_CLOSED;
	__rfcomm_dlc_close(d, err);

The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers
BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state
already BT_CLOSED that switch does not match and the function falls
through to rfcomm_dlc_unlink(), which sets d->session = NULL, while
d->defer_setup stays 1.

A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after
that point therefore skips the -ENOTCONN path -- sk->sk_state is
BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the
NULL session. No race is needed: once the DISC has been processed, the
dereference is unconditional.

Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over
/dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM
PSM, starts a session and sends SABM for a channel bound with
BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been
accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted
socket then hits:

 Oops: general protection fault, probably for non-canonical address
 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI
 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
 CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
 RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780
 Call Trace:
  <TASK>
  do_sock_getsockopt+0x3ad/0x7d0
  __sys_getsockopt+0x10e/0x1b0
  __x64_sys_getsockopt+0xc2/0x160
  do_syscall_64+0xda/0x4b0
  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  </TASK>

0x10 is the offset of sock in struct rfcomm_session;
rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt().

Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm_mutex for the
deferred setup accept") fixed the same "a remote DISC clears the session
while deferred setup is still flagged" problem in rfcomm_dlc_accept();
this is the remaining instance of it, in the getsockopt path.

Deferred setup only leaves a socket usable here once it has reached
BT_CONNECT2, so restrict the exception to that state and check that a
session is actually present before following it.

Fixes: bb23c0ab8246 ("Bluetooth: Add support for deferring RFCOMM connection setup")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
v2: Corrected the changelog. v1 claimed BT_DEFER_SETUP on a listening
socket stores into dlc->defer_setup; it does not - it sets
BT_SK_DEFER_SETUP in bt_sk(sk)->flags, and dlc->defer_setup is only set
on the child socket created by rfcomm_connect_ind(). The three-line
"reproducer" in v1 (socket/listen/setsockopt/getsockopt) consequently
could not have triggered anything and has been dropped. The real
trigger is a remote DISC unlinking the session of an already accepted
deferred-setup dlc, which is what the reproducer actually did. Also
added the Fixes: and Cc: stable tags. Apologies for the noise on v1.

Behaviour change worth noting: deferred-setup sockets whose session has
gone away now get -ENOTCONN instead of crashing, and deferred-setup
sockets outside BT_CONNECT2 also get -ENOTCONN.

 net/bluetooth/rfcomm/sock.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -786,8 +786,10 @@ static int rfcomm_sock_getsockopt_old(st
 		break;
 
 	case RFCOMM_CONNINFO:
-		if (sk->sk_state != BT_CONNECTED &&
-					!rfcomm_pi(sk)->dlc->defer_setup) {
+		if ((sk->sk_state != BT_CONNECTED &&
+		     !(sk->sk_state == BT_CONNECT2 &&
+		       rfcomm_pi(sk)->dlc->defer_setup)) ||
+		    !rfcomm_pi(sk)->dlc->session) {
 			err = -ENOTCONN;
 			break;
 		}
-- 
2.43.0

RE: [v2] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1838 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1169237/

---Test result---

Test Summary:
CheckPatch                    PASS      0.70 seconds
VerifyFixes                   PASS      0.14 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       FAIL      0.34 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      23.02 seconds
CheckAllWarning               PASS      26.91 seconds
CheckSparse                   PASS      27.97 seconds
BuildKernel32                 PASS      22.45 seconds
CheckKernelLLVM               PASS      24.55 seconds
TestRunnerSetup               PASS      579.05 seconds
TestRunner_rfcomm-tester      PASS      7.01 seconds
IncrementalBuild              PASS      22.17 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v2] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

6: B3 Line contains hard tab characters (\t): "	if (sk->sk_state != BT_CONNECTED &&"
7: B3 Line contains hard tab characters (\t): "				!rfcomm_pi(sk)->dlc->defer_setup) {"
8: B3 Line contains hard tab characters (\t): "		err = -ENOTCONN;"
9: B3 Line contains hard tab characters (\t): "		break;"
10: B3 Line contains hard tab characters (\t): "	}"
11: B3 Line contains hard tab characters (\t): "	l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;"
20: B3 Line contains hard tab characters (\t): "	d->state = BT_CLOSED;"
21: B3 Line contains hard tab characters (\t): "	__rfcomm_dlc_close(d, err);"


https://github.com/bluez/bluetooth-next/pull/797

---
Regards,
Linux Bluetooth

RE: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2422 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1169190/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.76 seconds
VerifyFixes                   PASS      0.13 seconds
VerifySignedoff               PASS      0.13 seconds
GitLint                       FAIL      0.33 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      28.91 seconds
CheckAllWarning               PASS      33.09 seconds
CheckSparse                   PASS      35.63 seconds
BuildKernel32                 PASS      28.67 seconds
CheckKernelLLVM               PASS      34.55 seconds
TestRunnerSetup               PASS      773.03 seconds
TestRunner_rfcomm-tester      PASS      5.65 seconds
IncrementalBuild              PASS      26.72 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
WARNING: The commit message has 'Call Trace:', perhaps it also needs a 'Fixes:' tag?

total: 0 errors, 1 warnings, 0 checks, 12 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14831156.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

6: B3 Line contains hard tab characters (\t): "	if (sk->sk_state != BT_CONNECTED &&"
7: B3 Line contains hard tab characters (\t): "				!rfcomm_pi(sk)->dlc->defer_setup) {"
8: B3 Line contains hard tab characters (\t): "		err = -ENOTCONN;"
9: B3 Line contains hard tab characters (\t): "		break;"
10: B3 Line contains hard tab characters (\t): "	}"
11: B3 Line contains hard tab characters (\t): "	l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;"


https://github.com/bluez/bluetooth-next/pull/795

---
Regards,
Linux Bluetooth

Re: [PATCH v2] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Sat, 19 Sep 2026 11:25:18 +0000 you wrote:
> The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not
> connected as long as deferred setup is enabled:
> 
> 	if (sk->sk_state != BT_CONNECTED &&
> 				!rfcomm_pi(sk)->dlc->defer_setup) {
> 		err = -ENOTCONN;
> 		break;
> 	}
> 	l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
    https://git.kernel.org/bluetooth/bluetooth-next/c/46f8ffd0a1f1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html