[PATCH 3/3] Bluetooth: hci_conn: fix UAF in hci_enhanced_setup_sync

[Aaron Esau <aaron1esau@gmail.com>]

From: Aaron Esau <aaron1esau@gmail.com>

hci_setup_sync queues hci_enhanced_setup_sync with conn_handle as data
without taking a reference on conn. hci_conn_del tries to dequeue with
conn as data, but the pointer comparison fails (data is conn_handle).
The existing hci_conn_valid check has a TOCTOU gap since conn can be
freed after the check passes. conn_handle also leaks on cancellation
because no destroy callback is set.

Take hci_conn_get on conn, add a destroy callback that frees
conn_handle and drops the reference, and move kfree(conn_handle) from
the sync function to the destroy callback.

Fixes: e07a06b4eb41 ("Bluetooth: Convert SCO configure_datapath to hci_sync")
Signed-off-by: Aaron Esau <aaron1esau@gmail.com>
---
 net/bluetooth/hci_conn.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index a7faa4c..6a567d6 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -278,6 +278,15 @@ error:
 	return err;
 }
 
+static void hci_enhanced_setup_sync_complete(struct hci_dev *hdev,
+					     void *data, int err)
+{
+	struct conn_handle_t *conn_handle = data;
+
+	hci_conn_put(conn_handle->conn);
+	kfree(conn_handle);
+}
+
 static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 {
 	struct conn_handle_t *conn_handle = data;
@@ -286,8 +295,6 @@ static int hci_enhanced_setup_sync(struct hci_dev *hdev, void *data)
 	struct hci_cp_enhanced_setup_sync_conn cp;
 	const struct sco_param *param;
 
-	kfree(conn_handle);
-
 	if (!hci_conn_valid(hdev, conn))
 		return -ECANCELED;
 
@@ -467,12 +474,15 @@ bool hci_setup_sync(struct hci_conn *conn, __u16 handle)
 		if (!conn_handle)
 			return false;
 
-		conn_handle->conn = conn;
+		conn_handle->conn = hci_conn_get(conn);
 		conn_handle->handle = handle;
 		result = hci_cmd_sync_queue(conn->hdev, hci_enhanced_setup_sync,
-					    conn_handle, NULL);
-		if (result < 0)
+					    conn_handle,
+					    hci_enhanced_setup_sync_complete);
+		if (result < 0) {
+			hci_conn_put(conn);
 			kfree(conn_handle);
+		}
 
 		return result == 0;
 	}
-- 
2.52.0