From patchwork Fri Jan 14 16:44:02 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Soenke Huster X-Patchwork-Id: 533312 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B19E3C433F5 for ; Fri, 14 Jan 2022 16:44:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243542AbiANQoU (ORCPT ); Fri, 14 Jan 2022 11:44:20 -0500 Received: from giacobini.uberspace.de ([185.26.156.129]:52292 "EHLO giacobini.uberspace.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239419AbiANQoT (ORCPT ); Fri, 14 Jan 2022 11:44:19 -0500 Received: (qmail 16780 invoked by uid 990); 14 Jan 2022 16:44:17 -0000 Authentication-Results: giacobini.uberspace.de; auth=pass (plain) From: Soenke Huster To: Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , "David S. Miller" , Jakub Kicinski Cc: Soenke Huster , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3] Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt Date: Fri, 14 Jan 2022 17:44:02 +0100 Message-Id: <20220114164401.330248-1-soenke.huster@eknoes.de> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Rspamd-Bar: / X-Rspamd-Report: BAYES_HAM(-3) R_MISSING_CHARSET(0.5) MIME_GOOD(-0.1) MID_CONTAINS_FROM(1) SUSPICIOUS_RECIPS(1.5) X-Rspamd-Score: -0.1 Received: from unknown (HELO unkown) (::1) by giacobini.uberspace.de (Haraka/2.8.28) with ESMTPSA; Fri, 14 Jan 2022 17:44:17 +0100 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org This event is just specified for SCO and eSCO link types. On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, LE link type and a status that triggers the second case of the packet processing a NULL pointer dereference happens, as conn->link is NULL. Signed-off-by: Soenke Huster --- v3: Replace if with switch, reference spec I found this null pointer dereference while fuzzing bluetooth-next. On the described behaviour, a null ptr deref in line 4723 happens, as conn->link is NULL. According to the Core spec, Link_Type must be SCO or eSCO, all other values are reserved for future use. Checking that mitigates a null pointer dereference. net/bluetooth/hci_event.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index fc30f4c03d29..e47cde778b1c 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4661,6 +4661,19 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, struct hci_ev_sync_conn_complete *ev = data; struct hci_conn *conn; + switch (ev->link_type) { + case SCO_LINK: + case ESCO_LINK: + break; + default: + /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type + * for HCI_Synchronous_Connection_Complete is limited to + * either SCO or eSCO + */ + bt_dev_err(hdev, "Ignoring connect complete event for invalid link type"); + return; + } + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); hci_dev_lock(hdev);