[PATCH 0/4] Bluetooth: hci_sync: fix TOCTOU UAF in cmd_sync callbacks

[Michael Bommarito <michael.bommarito@gmail.com>]

Four hci_sync.c cmd_sync callbacks share a TOCTOU bug: each receives a
struct hci_conn pointer via void *data, calls hci_conn_valid() at
function entry, then dereferences the conn without holding a lifetime
reference. hci_disconn_complete_evt() running on hdev->workqueue
rx_work can call hci_conn_del() -> hci_conn_cleanup() -> put_device()
between the validity check and the body's first deref, freeing the
hci_conn slot. The cmd_sync work item then reads or writes through
the freed pointer.

The four callsites:

  net/bluetooth/hci_sync.c hci_le_create_conn_sync
  net/bluetooth/hci_sync.c hci_acl_create_conn_sync
  net/bluetooth/hci_sync.c hci_le_pa_create_sync
  net/bluetooth/hci_sync.c hci_le_big_create_sync

The fix shape used by commit 035c25007c9e ("Bluetooth: hci_sync: Fix
UAF in le_read_features_complete") and commit 0beddb0c380b
("Bluetooth: hci_conn: fix potential UAF in create_big_sync") is the
same one this series adopts: hci_conn_get() at the
cmd_sync_queue_once() call site so the conn slot stays valid for the
duration of the workqueue dispatch, with hci_conn_put() in the
completion handler.

Patch 1 introduces a small static helper hci_cmd_sync_queue_conn_once()
that centralises the get/put pair so it cannot be miscoded at each
queue site. The kerneldoc on the helper explains the -EEXIST contract.
Patches 2-4 convert the remaining three sites.

Each callback was reproduced under UML+KASAN against linux-next tip
commit bee6ea30c487 ("Add linux-next specific files for 20260421"):
all four produce a slab-use-after-free splat in cache kmalloc-8k
matching the syzbot trace cited in commit 035c25007c9e
("Bluetooth: hci_sync: Fix UAF in le_read_features_complete"). On
the patched kernel the reproducer returns -ECANCELED cleanly with
no splat.

An unprivileged process holding an AF_BLUETOOTH socket drives the
cmd_sync queue side (no CAP_* required); the racing freeing context
is hci_disconn_complete_evt() arriving via the controller, which an
adjacent attacker controlling a BLE / BR-EDR peer can drive.

Pauli Virtanen posted a series-wide variant of this fix as
https://lore.kernel.org/linux-bluetooth/e18591f264c50e15917cb8b9e5f9798d9880979d.1762100290.git.pav@iki.fi/
(PATCH v2 8/8, 2025-11-02); this series re-derives the fix on top of
current linux-next with per-site Fixes: tags and factors the get/put
pair into one helper. hci_le_past_sync is not included; the past path
uses a struct past_data wrapper, not a direct hci_conn *, so it does
not fit the same helper.

Aaron Esau's sibling fix for hci_enhanced_setup_sync() in hci_conn.c
covers the same pattern at a fifth callback,
https://lore.kernel.org/linux-bluetooth/20260330140347.906689-3-git@aaronesau.com/
(2026-03-30).

Build clean on UML+KASAN+SLUB (linux-next tip bee6ea30c487) with no
new warnings. checkpatch.pl --strict reports 0/0/0 on each patch.

Michael Bommarito (4):
  Bluetooth: hci_sync: pin conn across hci_le_create_conn_sync
  Bluetooth: hci_sync: pin conn across hci_le_pa_create_sync
  Bluetooth: hci_sync: pin conn across hci_le_big_create_sync
  Bluetooth: hci_sync: pin conn across hci_acl_create_conn_sync

 net/bluetooth/hci_sync.c | 77 ++++++++++++++++++++++++++++++++--------
 1 file changed, 61 insertions(+), 16 deletions(-)

--
2.53.0