public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_chan_timeout()
@ 2026-03-19 15:14 Hyunwoo Kim
  2026-03-19 15:55 ` Luiz Augusto von Dentz
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Hyunwoo Kim @ 2026-03-19 15:14 UTC (permalink / raw)
  To: marcel, johan.hedberg, luiz.dentz; +Cc: linux-bluetooth, imv4bel

l2cap_chan_timeout() reads chan->conn without holding any lock and
without taking a reference on the connection. If l2cap_conn_del()
frees the connection concurrently, mutex_lock(&conn->lock) operates
on freed memory. The existing NULL check is insufficient as it cannot
prevent the connection from being freed after the check passes, and
the early return also leaks the channel reference held by the timer.

Fix by reading chan->conn under l2cap_chan_lock() and holding the
connection with l2cap_conn_get(). After acquiring locks in the correct
order (conn->lock then chan->lock), re-verify chan->conn in case
l2cap_conn_del() already cleaned up the channel.

Fixes: 3df91ea20e74 ("Bluetooth: Revert to mutexes from RCU list")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/bluetooth/l2cap_core.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index abd091155d04..a432e94281dc 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -406,13 +406,20 @@ static void l2cap_chan_timeout(struct work_struct *work)
 {
 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
 					       chan_timer.work);
-	struct l2cap_conn *conn = chan->conn;
+	struct l2cap_conn *conn;
 	int reason;
 
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
-	if (!conn)
+	l2cap_chan_lock(chan);
+	conn = chan->conn;
+	if (!conn) {
+		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
 		return;
+	}
+	l2cap_conn_get(conn);
+	l2cap_chan_unlock(chan);
 
 	mutex_lock(&conn->lock);
 	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
@@ -420,6 +427,17 @@ static void l2cap_chan_timeout(struct work_struct *work)
 	 */
 	l2cap_chan_lock(chan);
 
+	/* Recheck since l2cap_conn_del() may have cleaned up the channel
+	 * while we were waiting for conn->lock.
+	 */
+	if (!chan->conn) {
+		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
+		mutex_unlock(&conn->lock);
+		l2cap_conn_put(conn);
+		return;
+	}
+
 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
 		reason = ECONNREFUSED;
 	else if (chan->state == BT_CONNECT &&
@@ -436,6 +454,7 @@ static void l2cap_chan_timeout(struct work_struct *work)
 	l2cap_chan_put(chan);
 
 	mutex_unlock(&conn->lock);
+	l2cap_conn_put(conn);
 }
 
 struct l2cap_chan *l2cap_chan_create(void)
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-04-09 20:01 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-19 15:14 [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_chan_timeout() Hyunwoo Kim
2026-03-19 15:55 ` Luiz Augusto von Dentz
2026-03-19 16:36 ` bluez.test.bot
2026-04-09 20:01 ` bluez.test.bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox