Re: [PATCH v3] Bluetooth: hci_conn: fix potential UAF in create_big_sync

[Pauli Virtanen <pav@iki.fi>]

Hi,

pe, 2026-04-10 kello 16:13 -0400, Luiz Augusto von Dentz kirjoitti:
> From: David Carlier <devnexen@gmail.com>
> 
> Add hci_conn_valid() check in create_big_sync() to detect stale
> connections before proceeding with BIG creation. Fix
> create_big_complete() to handle the resulting -ECANCELED error
> and validate the connection under hci_dev_lock() before
> dereferencing, following the established pattern used by
> create_le_conn_complete() and create_pa_complete().
> 
> Without this, create_big_complete() would unconditionally
> dereference the stale conn pointer on error, causing a
> use-after-free via hci_connect_cfm() and hci_conn_del().
> 
> Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
> Cc: stable@vger.kernel.org
> Signed-off-by: David Carlier <devnexen@gmail.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  net/bluetooth/hci_conn.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> index 3a0592599086..7e6b3542809c 100644
> --- a/net/bluetooth/hci_conn.c
> +++ b/net/bluetooth/hci_conn.c
> @@ -2130,6 +2130,9 @@ static int create_big_sync(struct hci_dev *hdev, void *data)
>  	u32 flags = 0;
>  	int err;
>  
> +	if (!hci_conn_valid(hdev, conn))
> +		return -ECANCELED;
> +
>  	if (qos->bcast.out.phys == BIT(1))
>  		flags |= MGMT_ADV_FLAG_SEC_2M;
>  
> @@ -2204,11 +2207,17 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)
>  
>  	bt_dev_dbg(hdev, "conn %p", conn);
>  
> +	if (err == -ECANCELED)
> +		goto done;
> +
>  	if (err) {
>  		bt_dev_err(hdev, "Unable to create BIG: %d", err);
>  		hci_connect_cfm(conn, err);
>  		hci_conn_del(conn);

hci_conn_del() is called without hci_dev_lock() here.

It probably should take the lock and check hci_conn_valid() inside the
critical section before calling into hci_conn_del().

Probably hci_conn_del() should have lockdep_assert_held(&hdev->lock)

>  	}
> +
> +done:
> +	hci_conn_put(conn);
>  }
>  
>  struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
> @@ -2336,10 +2345,11 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst,
>  				 BT_BOUND, &data);
>  
>  	/* Queue start periodic advertising and create BIG */
> -	err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
> +	err = hci_cmd_sync_queue(hdev, create_big_sync, hci_conn_get(conn),
>  				 create_big_complete);
>  	if (err < 0) {
>  		hci_conn_drop(conn);
> +		hci_conn_put(conn);
>  		return ERR_PTR(err);
>  	}
>  

-- 
Pauli Virtanen