[PATCH v2 0/1] Bluetooth: msft: fix vendor event use-after-free during open

[Ren Wei <weir@nebusec.ai>]

From: Yong Wang <edragain@163.com>

Hi Linux maintainers,

This patch fixes a race between `msft_do_open()` and `msft_vendor_evt()`.

Commit 5031ffcc79b8 ("Bluetooth: Keep MSFT ext info throughout a
hci_dev's life cycle") changed the open path to reuse the live
`hdev->msft_data` object across power cycles. As a result,
`msft_do_open()` may replace `msft->evt_prefix` while vendor events are
still being processed during device initialization.

At the same time, `msft_vendor_evt()` reads `hdev->msft_data` and checks
the event prefix before taking `hci_dev_lock()`. This can race with the
open path and lead to a use-after-free on the prefix buffer, and on the
failure path it can also observe stale `msft_data` state.

Fix this by reading the supported feature data into temporary storage
first and only publishing the updated MSFT state while holding
`hci_dev_lock()`. Also make `msft_vendor_evt()` take `hci_dev_lock()`
before inspecting the published MSFT state.

We tested the fix and verified that the crash no longer occurs. We also
verified that the existing MSFT monitor functionality still works.

Thanks,
Yong

Changes in v2:
- Rework the cover letter to present this as a race/UAF fix rather than
  a security issue.
- Trim reproducer details that are not needed for patch review.
- No functional code changes.
v1 Link: https://lore.kernel.org/all/ea4efa51cc3be16d3eb7726fe5486f0be6c47907.1786092373.git.edragain@163.com/

Yong Wang (1):
  Bluetooth: msft: fix vendor event use-after-free during open

 net/bluetooth/msft.c | 70 +++++++++++++++++++++++++++-----------------
 1 file changed, 43 insertions(+), 27 deletions(-)

-- 
2.53.0