From patchwork Thu Jan 13 16:40:42 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Soenke Huster X-Patchwork-Id: 532076 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 992A3C433EF for ; Thu, 13 Jan 2022 16:41:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236813AbiAMQlY (ORCPT ); Thu, 13 Jan 2022 11:41:24 -0500 Received: from giacobini.uberspace.de ([185.26.156.129]:34840 "EHLO giacobini.uberspace.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232248AbiAMQlX (ORCPT ); Thu, 13 Jan 2022 11:41:23 -0500 Received: (qmail 25316 invoked by uid 990); 13 Jan 2022 16:41:22 -0000 Authentication-Results: giacobini.uberspace.de; auth=pass (plain) From: Soenke Huster To: Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , "David S. Miller" , Jakub Kicinski Cc: Soenke Huster , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2] Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt Date: Thu, 13 Jan 2022 17:40:42 +0100 Message-Id: <20220113164042.259990-1-soenke.huster@eknoes.de> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Rspamd-Bar: ++ X-Rspamd-Report: BAYES_HAM(-0.045106) R_MISSING_CHARSET(0.5) MIME_GOOD(-0.1) MID_CONTAINS_FROM(1) SUSPICIOUS_RECIPS(1.5) X-Rspamd-Score: 2.854893 Received: from unknown (HELO unkown) (::1) by giacobini.uberspace.de (Haraka/2.8.28) with ESMTPSA; Thu, 13 Jan 2022 17:41:22 +0100 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org This event is specified just for SCO and eSCO link types. On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, LE link type and a status that triggers the second case of the packet processing a NULL pointer dereference happens, as conn->link is NULL. Signed-off-by: Soenke Huster --- v2: Fixed the obviously wrong boolean comparison I found this null pointer dereference while fuzzing bluetooth-next. On the described behaviour, a null ptr deref in line 4723 happens, as conn->link is NULL. According to the Core spec, Link_Type must be SCO or eSCO, all other values are reserved for future use. Checking that mitigates a null pointer dereference. net/bluetooth/hci_event.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 05997dff5666..d68f5640fb38 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4661,6 +4661,11 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, struct hci_ev_sync_conn_complete *ev = data; struct hci_conn *conn; + if (!(ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK)) { + bt_dev_err(hdev, "Ignoring connect complete event for invalid link type"); + return; + } + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); hci_dev_lock(hdev);