[PATCH v2] Bluetooth: mgmt: fix race in read_unconf_index_list()

[PATCH v2] Bluetooth: mgmt: fix race in read_unconf_index_list()

[Aldo Ariel Panzardo]

read_unconf_index_list() counts unconfigured controllers before allocating
its response, then checks the device flags again while filling it.

hci_dev_list_lock stabilizes list membership, but it does not serialize the
per-device flags. During asynchronous controller setup, the worker can set
HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
omitted from the allocation count can then become eligible for the fill
pass, causing an out-of-bounds write to rp->index[].

Allocate space for every device on hci_dev_list. Since list membership
cannot change while hci_dev_list_lock is held, the response remains large
enough regardless of flag transitions. The reported count and response
length still include only eligible unconfigured controllers.

Fixes: 73d1df2a7a10 ("Bluetooth: Add support for Read Unconfigured Index List command")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 net/bluetooth/mgmt.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 167d75e34..1f6691278 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -496,13 +496,9 @@ static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev,
 
 	read_lock(&hci_dev_list_lock);
 
-	count = 0;
-	list_for_each_entry(d, &hci_dev_list, list) {
-		if (hci_dev_test_flag(d, HCI_UNCONFIGURED))
-			count++;
-	}
+	count = list_count_nodes(&hci_dev_list);
 
-	rp_len = sizeof(*rp) + (2 * count);
+	rp_len = sizeof(*rp) + (sizeof(__le16) * count);
 	rp = kmalloc(rp_len, GFP_ATOMIC);
 	if (!rp) {
 		read_unlock(&hci_dev_list_lock);
-- 
2.43.0

RE: [v2] Bluetooth: mgmt: fix race in read_unconf_index_list()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1403 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165728/

---Test result---

Test Summary:
CheckPatch                    PASS      0.74 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.33 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      29.77 seconds
CheckAllWarning               PASS      33.94 seconds
CheckSparse                   PASS      37.81 seconds
BuildKernel32                 PASS      29.75 seconds
CheckKernelLLVM               PASS      35.40 seconds
TestRunnerSetup               PASS      818.19 seconds
TestRunner_mgmt-tester        FAIL      9.09 seconds
TestRunner_mesh-tester        FAIL      7.86 seconds
IncrementalBuild              PASS      28.25 seconds

Details
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
No test result found


https://github.com/bluez/bluetooth-next/pull/773

---
Regards,
Linux Bluetooth

Re: [PATCH v2] Bluetooth: mgmt: fix race in read_unconf_index_list()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 15 Sep 2026 12:59:52 -0300 you wrote:
> read_unconf_index_list() counts unconfigured controllers before allocating
> its response, then checks the device flags again while filling it.
> 
> hci_dev_list_lock stabilizes list membership, but it does not serialize the
> per-device flags. During asynchronous controller setup, the worker can set
> HCI_UNCONFIGURED and clear HCI_SETUP between the two passes. A controller
> omitted from the allocation count can then become eligible for the fill
> pass, causing an out-of-bounds write to rp->index[].
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: mgmt: fix race in read_unconf_index_list()
    https://git.kernel.org/bluetooth/bluetooth-next/c/b5dbb41b212c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html