Bluetooth: msft: fix vendor event use-after-free during open

From: Yong Wang <[email protected]>

Hi Linux maintainers,

This patch fixes a race between msft_do_open() and msft_vendor_evt().

Commit 5031ffcc79b8 ("Bluetooth: Keep MSFT ext info throughout a hci_dev's life cycle") changed the open path to reuse the live hdev->msft_data object across power cycles. As a result, msft_do_open() may replace msft->evt_prefix while vendor events are still being processed during device initialization.

At the same time, msft_vendor_evt() reads hdev->msft_data and checks the event prefix before taking hci_dev_lock(). This can race with the open path and lead to a use-after-free on the prefix buffer, and on the failure path it can also observe stale msft_data state.

Fix this by reading the supported feature data into temporary storage first and only publishing the updated MSFT state while holding hci_dev_lock(). Also make msft_vendor_evt() take hci_dev_lock() before inspecting the published MSFT state.

We tested the fix and verified that the crash no longer occurs. We also verified that the existing MSFT monitor functionality still works.

Thanks,
Yong

Changes in v2:
- Rework the cover letter to present this as a race/UAF fix rather than
a security issue.
- Trim reproducer details that are not needed for patch review.
- No functional code changes.
v1 Link: https://lore.kernel.org/all/ea4efa51cc3be16d3eb7726fe5486f0be6c47907.1786092373.git.edragain@163.com/

Changes in v3:
- Rebase onto the current net tree after 0079e1a94463 ("Bluetooth: MSFT: validate evt_prefix_len against the response length")
- No functional code changes
v2 Link: https://lore.kernel.org/all/[email protected]/

Yong Wang (1):
Bluetooth: msft: fix vendor event use-after-free during open

 net/bluetooth/msft.c | 70 +++++++++++++++++++++++++++-----------------
 1 file changed, 43 insertions(+), 27 deletions(-)

2.53.0