[PATCH] Bluetooth: hci_sync: Drain LE timeouts before disconnecting

[PATCH] Bluetooth: hci_sync: Drain LE timeouts before disconnecting

[Cen Zhang]

A pending LE peripheral connection can be deleted by power-off while its
le_conn_timeout callback is running on hdev->workqueue. The callback uses
a raw hci_conn pointer and waits for hdev->lock before calling
hci_conn_failed(). On the request workqueue, hci_disconnect_all_sync() can
abort the same connection first. hci_conn_del() cancels the timeout
without waiting for a running callback, and the walker's final
hci_conn_put() can free the connection before the timeout resumes. The
subsequent conn->hdev read in hci_conn_failed() is a use-after-free.

Disable and drain le_conn_timeout in hci_disconnect_all_sync() before
hci_abort_conn_sync(), while the walker's existing reference still keeps
the connection alive. Do this outside RCU and before taking hdev->lock so
the callback can finish, and prevent the timeout from being requeued
during teardown. If the callback removes the connection, the existing
hash check in hci_abort_conn_sync() avoids deleting it again.

A matching KASAN report from an instrumented kernel showed:
 BUG: KASAN: slab-use-after-free in hci_conn_failed+0x3f8/0x410
    Read of size 8 at addr ffff888119e391b0 by task
    Workqueue: hci0 le_conn_timeout
    [...]
    hci_conn_failed+0x3f8/0x410
    le_conn_timeout+0x286/0x360
    [...]
    Freed by task 509:
    [...]
    bt_link_release+0x87/0x180
    [...]
    put_device+0x24/0x30
    hci_disconnect_all_sync.constprop.0+0x163/0x460
    hci_set_powered_sync+0x48f/0x680
    [...]

Fixes: 94d9ba9f9888 ("Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index efbd2e5387c0b..ba573aeebba88 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -6083,6 +6083,15 @@ static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason)
 		/* Make sure the connection is not freed while unlocking */
 		conn = hci_conn_get(conn);
 		rcu_read_unlock();
+
+		/*
+		 * The LE timeout takes hdev->lock, so drain it before
+		 * deleting the connection. The reference above keeps it
+		 * alive while waiting.
+		 */
+		if (conn->type == LE_LINK)
+			disable_delayed_work_sync(&conn->le_conn_timeout);
+
 		/* Disregard possible errors since hci_conn_del shall have been
 		 * called even in case of errors had occurred since it would
 		 * then cause hci_conn_failed to be called which calls

RE: Bluetooth: hci_sync: Drain LE timeouts before disconnecting

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1881 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1184935/

---Test result---

Test Summary:
CheckPatch                    PASS      0.67 seconds
VerifyFixes                   PASS      9.42 seconds
VerifySignedoff               PASS      2.61 seconds
GitLint                       PASS      0.80 seconds
SubjectPrefix                 PASS      0.20 seconds
BuildKernel                   PASS      29.46 seconds
CheckAllWarning               PASS      33.59 seconds
CheckSparse                   PASS      36.17 seconds
BuildKernel32                 PASS      29.23 seconds
CheckKernelLLVM               PASS      35.23 seconds
TestRunnerSetup               PASS      700.74 seconds
TestRunner_l2cap-tester       PASS      12.59 seconds
TestRunner_iso-tester         PASS      11.22 seconds
TestRunner_bnep-tester        PASS      3.10 seconds
TestRunner_mgmt-tester        FAIL      89.64 seconds
TestRunner_rfcomm-tester      PASS      4.44 seconds
TestRunner_sco-tester         PASS      5.58 seconds
TestRunner_ioctl-tester       PASS      4.63 seconds
TestRunner_mesh-tester        PASS      5.48 seconds
TestRunner_smp-tester         PASS      4.31 seconds
TestRunner_userchan-tester    PASS      3.17 seconds
TestRunner_6lowpan-tester     PASS      4.39 seconds
IncrementalBuild              PASS      27.86 seconds

Details
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 508, Passed: 507 (99.8%), Failed: 1, Not Run: 0

Failed Test Cases
Pairing Acceptor - SMP over BR/EDR 2                 Timed out    2.289 seconds


https://github.com/bluez/bluetooth-next/pull/923

---
Regards,
Linux Bluetooth