FAILED: patch "[PATCH] Bluetooth: hci_conn: Fix UAF Write in" failed to apply to 6.1-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 5f641f03abccddd1a37233ff1b8e774b9ff1f4e8
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026101307-tableware-velvet-7ee4@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 5f641f03abccddd1a37233ff1b8e774b9ff1f4e8 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <[email protected]>
Date: Fri, 9 Feb 2024 09:08:06 -0500
Subject: [PATCH] Bluetooth: hci_conn: Fix UAF Write in
__hci_acl_create_connection_sync
This fixes the UAF on __hci_acl_create_connection_sync caused by connection abortion, it uses the same logic as to LE_LINK which uses hci_cmd_sync_cancel to prevent the callback to run if the connection is abort prematurely.
include/net/bluetooth/hci_sync.h +1 -2
@@ -139,5 +139,4 @@ int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle);int hci_le_pa_terminate_sync (struct hci_dev *hdev,u16 handle); -int hci_acl_create_connection_sync (struct hci_dev *hdev, -struct hci_conn *conn); +int hci_connect_acl_sync (struct hci_dev *hdev,struct hci_conn *conn);
net/bluetooth/hci_conn.c +2 -1
@@ -1645,7 +1645,7 @@ struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, acl->auth_type = auth_type; acl->conn_timeout = timeout; - err =hci_acl_create_connection_sync (hdev, acl); + err =hci_connect_acl_sync (hdev, acl);if (err) {hci_conn_del (acl);return ERR_PTR (err);
@@ -2942,6 +2942,7 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason)*/ if (conn->state ==BT_CONNECT && hdev->req_status ==HCI_REQ_PEND ) {switch (hci_skb_event (hdev->sent_cmd)) { +case HCI_EV_CONN_COMPLETE :case HCI_EV_LE_CONN_COMPLETE :case HCI_EV_LE_ENHANCED_CONN_COMPLETE :case HCI_EVT_LE_CIS_ESTABLISHED :
net/bluetooth/hci_sync.c +10 -6
@@ -6493,13 +6493,18 @@ int hci_update_adv_data(struct hci_dev *hdev, u8 instance) UINT_PTR(instance), NULL); } -static int __hci_acl_create_connection_sync (struct hci_dev *hdev,void *data) +static int hci_acl_create_conn_sync (struct hci_dev *hdev,void *data) { -struct hci_conn *conn = data; +struct hci_conn *conn; +u16 handle =PTR_UINT (data);struct inquiry_entry *ie;struct hci_cp_create_conn cp;int err; + conn =hci_conn_hash_lookup_handle (hdev, handle); +if (!conn) +return 0 ; +/* Many controllers disallow HCI Create Connection while it is doing * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create * Connection. This may cause the MGMT discovering state to become false
@@ -6556,9 +6561,8 @@ static int __hci_acl_create_connection_sync(struct hci_dev *hdev, void *data)return err; } -int hci_acl_create_connection_sync (struct hci_dev *hdev, -struct hci_conn *conn) +int hci_connect_acl_sync (struct hci_dev *hdev,struct hci_conn *conn) { -return hci_cmd_sync_queue (hdev, __hci_acl_create_connection_sync, - conn,NULL ); +return hci_cmd_sync_queue (hdev, hci_acl_create_conn_sync, +UINT_PTR (conn->handle),NULL ); }