[ Sasha's backport helper bot ]
Hi,
The upstream commit SHA1 provided is correct: 333b4fd11e89b29c84c269123f871883a30be586
WARNING: Author mismatch between patch and upstream commit: Backport author: d.privalov d.privalov@omp.ru Commit author: Luiz Augusto von Dentz luiz.von.dentz@intel.com
Status in newer kernel trees: 6.12.y | Present (exact SHA1) 6.6.y | Present (different SHA1: b90907696c30) 6.1.y | Present (different SHA1: b22346eec479) 5.15.y | Present (different SHA1: 686e05c9dbd6) 5.10.y | Not found
Note: The patch differs from the upstream commit: --- 1: 333b4fd11e89 ! 1: b709013bb07e Bluetooth: L2CAP: Fix uaf in l2cap_connect @@ Metadata ## Commit message ## Bluetooth: L2CAP: Fix uaf in l2cap_connect
+ commit 333b4fd11e89b29c84c269123f871883a30be586 upstream. + [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 @@ Commit message Closes: https://syzkaller.appspot.com/bug?extid=c12e2f941af1feb5632c Fixes: 7b064edae38d ("Bluetooth: Fix authentication if acl data comes before remote feature evt") Signed-off-by: Luiz Augusto von Dentz luiz.von.dentz@intel.com + Signed-off-by: Dmitriy Privalov d.privalov@omp.ru
## net/bluetooth/hci_core.c ## @@ net/bluetooth/hci_core.c: static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) @@ net/bluetooth/hci_core.c: static void hci_acldata_packet(struct hci_dev *hdev, s hci_dev_lock(hdev); conn = hci_conn_hash_lookup_handle(hdev, handle); + if (conn && hci_dev_test_flag(hdev, HCI_MGMT)) -+ mgmt_device_connected(hdev, conn, NULL, 0); ++ mgmt_device_connected(hdev, conn, 0, NULL, 0); hci_dev_unlock(hdev);
if (conn) {
## net/bluetooth/hci_event.c ## -@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *hdev, void *data, +@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *hdev, goto unlock; }
@@ net/bluetooth/hci_event.c: static void hci_remote_features_evt(struct hci_dev *h bacpy(&cp.bdaddr, &conn->dst);
## net/bluetooth/l2cap_core.c ## -@@ net/bluetooth/l2cap_core.c: static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, +@@ net/bluetooth/l2cap_core.c: static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, static int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) { @@ net/bluetooth/l2cap_core.c: static void l2cap_connect(struct l2cap_conn *conn, s return -EPROTO;
- hci_dev_lock(hdev); -- if (hci_dev_test_flag(hdev, HCI_MGMT)) -- mgmt_device_connected(hdev, hcon, NULL, 0); +- if (hci_dev_test_flag(hdev, HCI_MGMT) && +- !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags)) +- mgmt_device_connected(hdev, hcon, 0, NULL, 0); - hci_dev_unlock(hdev); - - l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP); + l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0); return 0; } ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Success |