From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 964FE436353 for ; Mon, 20 Jul 2026 16:47:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784566074; cv=none; b=RMEk9xyOqplwDmQKdm1csT/CDSQZIzBpgD8Tcp9On/kbwvnRKowkuJQUMqM3Vtuq0hLUzjRPPmBe85xSiyy0r4G88bYe6iQu3kjUOYWLI7Bzwa8S7UzXInu1XfjIhtGmQHb/zrx9j0LyL3ex4efmDSkkJlAIr/eKZXvuKGwRoSA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784566074; c=relaxed/simple; bh=Oti1msIlvTX5aDbLqPUB5RsoSmps0p87NYEbSnq/5kk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XS4tunYe7QGpg4fV4tHUFYW8/VbGhpw++4IWr62GWwlM45Ux3Do1fsBX2eTwvxH8DWcohX9zKMv5uQZxWIMSKfNEpAuznG+d/b3U5KRELq9A8t2mloxuV4pEk7s6BE/YoLgTAg5DDAUGBcYTpfyTHZkGiIOKqdpvMlP2YTtWaAM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ij3rrWpk; arc=none smtp.client-ip=209.85.216.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ij3rrWpk" Received: by mail-pj1-f50.google.com with SMTP id 98e67ed59e1d1-38dd1cc8dc8so1069194a91.0 for ; Mon, 20 Jul 2026 09:47:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784566068; x=1785170868; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=AXskwc2WtSB6mLoqDGsJMTeDVD+Exvdvy305sSbWnFk=; b=ij3rrWpk4htzUBJTQh/RlpU0UZnCOChLydwio8wSGspPWnCKsrxQatmiQHGGIp5b+G DRr3tnIshrrBQAnyS1bE/vPdm7NiSmgDwoO4DIUhX/e0tUMShzxQy8TjYIzzvvnayPBS VVUrSst3cqxlmSZTSjrOmNYIH3+E8TTMDfbqoLiGYN9aPvS7u74mfndAm0DhBeFw5cv4 MtNAGUp451AW9pqXws1KTkV9Q/l+W2Vrk8b92cq5iFmOy8CtEiU87JzgOq8g6ZiZGCb9 JAnTulzxCw+4asuIj2QvB7IVTirmR+s0U9zyfLsQRPqkYHTbA366/8tK1bKzMyXmvAt7 V7gA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784566068; x=1785170868; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AXskwc2WtSB6mLoqDGsJMTeDVD+Exvdvy305sSbWnFk=; b=FNHYFOmgY6/+5IYwnBf9W43tBDZBS9MTqvQz59Ju0l8rxwDZar/1IxAxEPb/Lh8K6r sILbp1eUrekq5sMQpMhzXLJMntL12z/CDffvRzoUmAK90Gt3RtG1FfR2JWvtvznfgqk4 oI4ofQwy1kHI4nVN9VJLKD313lKwm/nrM9V4HJ27gJKad3Bmh9wh4usNRckIfSf8Ehmv iPVXYc3T8LfrZg7CmNvNgbZr/09z1Paastgv42RMydNoR3nQnrf7e+tL3Px0ZABrXukJ SSm/3mq69sUQV/WlvIVOf9Q0LDCOcXUjcJoizeuzzF6dIrkvR/gl+uTdnvgLNG+difOl cp2g== X-Forwarded-Encrypted: i=1; AHgh+RqtB6TitkE48Lkq7ZRyT2QwL7UH+FX3kMgw4cDHsNp5EOhYfrg4bSJTNofzo3Z7Zx/0bfnCm5sy7z2RHDQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzARfjZ74aOkR7ZpKbu/ediDaTADip1Vm1Q27vResd1grj4YjjI +9WsMD0aNtSk07qDVzhqs7Pu2bHtdXQRTLLBho2v/q0N6sWr9BShvfed X-Gm-Gg: AR+sD13hGs+jp1idzSmc5j9yWpplCS3gXCB6LFtgy0YLNEJs4HwIL0RrO8kPRvMp4yu 7mnABpFdZiT1gNAALrIZQKwi0PGg7mSUdMMnw1NlnAJ+DPVmCjRDICMF9UWKEDbwT58dBTcM+ue 5L/hiKFI//zAWh0ppO6aagosPxuXctOq1obP9N6vfg1t6A0KpyuNEpBkMWH2pVsFg52+xPNlpbv mmminhhqm4SAakNTgMVgMST1r5pploXEiEAz9mw2WQc7qV5mizKVmrwsYLPwaHJ7eFm4mHA5HpY tyH5TZxBA7F9mEeL52t6+9gn7lwFQzc9WJ9cy7h/0GG+aXM7UV3BUCwQRSfLWxiJI0lsQc80LWG 0gWgEoo1TNnVDDHHd5TLHYd6a7bq6rWI9R8vcWs02GQC6MqLrOl4zSb8quocda8IxG3TtutdmZF GNQia44I5Mfy4wTiptPCg8/4MzvQw2Pa50pKGdRanEmcLjVWh+G8X5leX66X031GOGps7i X-Received: by 2002:a17:90b:2fc3:b0:38d:90c1:2400 with SMTP id 98e67ed59e1d1-38e4b3d5042mr12353703a91.2.1784566068190; Mon, 20 Jul 2026 09:47:48 -0700 (PDT) Received: from localhost.localdomain (45.78.65.84.16clouds.com. [45.78.65.84]) by smtp.gmail.com with ESMTPSA id a92af1059eb24-13ce2a18a47sm34309143c88.8.2026.07.20.09.47.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 09:47:47 -0700 (PDT) From: Chengfeng Ye To: Marcel Holtmann , Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Chengfeng Ye , stable@vger.kernel.org Subject: [PATCH] Bluetooth: hci_sync: Fix scan response data UAF Date: Tue, 21 Jul 2026 00:47:38 +0800 Message-ID: <20260720164738.2921802-1-nicoyip.dev@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit eir_create_scan_rsp() calls hci_find_adv_instance(), whose return value is valid only while hdev->lock is held. After advertising setup was moved to hci_cmd_sync_work, neither scan response data builder held that lock. hci_set_ext_scan_rsp_data_sync() also kept the returned pointer while waiting for the controller and wrote scan_rsp_changed through it afterward. An advertising termination event can therefore interleave as follows: hci_cmd_sync_work hci_rx_work hci_find_adv_instance() __hci_cmd_sync_status() wait for controller reply hci_dev_lock() hci_remove_adv_instance() kfree(adv) adv->scan_rsp_changed = false KASAN reported: BUG: KASAN: slab-use-after-free in hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 Write of size 1 at addr ffff88810a45d21d by task kworker/u17:0/88 Workqueue: hci0 hci_cmd_sync_work Call Trace: hci_set_ext_scan_rsp_data_sync+0x2e1/0x300 hci_schedule_adv_instance_sync+0x390/0x4c0 hci_cmd_sync_work+0x173/0x300 Allocated by task 87: hci_add_adv_instance+0x538/0xac0 add_advertising+0x885/0x1160 Freed by task 89: kfree+0x131/0x3c0 hci_remove_adv_instance+0x1d8/0x3b0 hci_le_ext_adv_term_evt+0x17b/0x730 Hold hdev->lock while looking up the instance, building the scan response, and clearing its dirty bit. Clear the bit before waiting for the controller so no adv_info pointer survives the wait, and restore it under the lock if the command fails. This also preserves an update that races with a successful command because that update sets the bit again. Protect the legacy scan response builder with the same lock. Fixes: cba6b758711c ("Bluetooth: hci_sync: Make use of hci_cmd_sync_queue set 2") Cc: stable@vger.kernel.org Signed-off-by: Chengfeng Ye --- net/bluetooth/hci_sync.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 532534bc601c..8c69a98c71e8 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -1490,9 +1490,13 @@ static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) int err; if (instance) { + hci_dev_lock(hdev); + adv = hci_find_adv_instance(hdev, instance); - if (!adv || !adv->scan_rsp_changed) + if (!adv || !adv->scan_rsp_changed) { + hci_dev_unlock(hdev); return 0; + } } len = eir_create_scan_rsp(hdev, instance, pdu->data); @@ -1502,15 +1506,27 @@ static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG; + if (adv) { + adv->scan_rsp_changed = false; + hci_dev_unlock(hdev); + } + err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, struct_size(pdu, data, len), pdu, HCI_CMD_TIMEOUT); - if (err) + if (err) { + if (instance) { + hci_dev_lock(hdev); + adv = hci_find_adv_instance(hdev, instance); + if (adv) + adv->scan_rsp_changed = true; + hci_dev_unlock(hdev); + } + return err; + } - if (adv) { - adv->scan_rsp_changed = false; - } else { + if (!instance) { memcpy(hdev->scan_rsp_data, pdu->data, len); hdev->scan_rsp_data_len = len; } @@ -1525,8 +1541,14 @@ static int __hci_set_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) memset(&cp, 0, sizeof(cp)); + if (instance) + hci_dev_lock(hdev); + len = eir_create_scan_rsp(hdev, instance, cp.data); + if (instance) + hci_dev_unlock(hdev); + if (hdev->scan_rsp_data_len == len && !memcmp(cp.data, hdev->scan_rsp_data, len)) return 0; -- 2.43.0