Bluetooth: Fix double free in hci_conn_cleanup

Commit Message

ZhengHan Wang March 9, 2023, 7:46 a.m. UTC

syzbot reports a slab use-after-free in hci_conn_hash_flush [1].
After releasing an object using hci_conn_del_sysfs in the 
hci_conn_cleanup function, releasing the same object again 
using the hci_dev_put and hci_conn_put functions causes a double free.
Here's a simplified flow:

hci_conn_del_sysfs:
  hci_dev_put
    put_device
      kobject_put
        kref_put
          kobject_release
            kobject_cleanup
              kfree_const
                kfree(name)

hci_dev_put:
  ...
    kfree(name)

hci_conn_put:
  put_device
    ...
      kfree(name)

This patch drop the hci_dev_put and hci_conn_put function 
call in hci_conn_cleanup function, because the object is 
freed in hci_conn_del_sysfs function.

Link: https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419 [1]

Signed-off-by: ZhengHan Wang <[e-mail]>
---
 net/bluetooth/hci_conn.c | 4 ----
 1 file changed, 4 deletions(-)

Comments

[e-mail] March 9, 2023, 8:43 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=728135

---Test result---

Test Summary:
CheckPatch                    PASS      0.79 seconds
GitLint                       FAIL      0.66 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      46.02 seconds
CheckAllWarning               PASS      50.61 seconds
CheckSparse                   PASS      56.37 seconds
CheckSmatch                   PASS      151.79 seconds
BuildKernel32                 PASS      44.10 seconds
TestRunnerSetup               PASS      629.37 seconds
TestRunner_l2cap-tester       PASS      20.59 seconds
TestRunner_iso-tester         PASS      22.83 seconds
TestRunner_bnep-tester        PASS      8.18 seconds
TestRunner_mgmt-tester        FAIL      146.90 seconds
TestRunner_rfcomm-tester      PASS      12.44 seconds
TestRunner_sco-tester         PASS      11.54 seconds
TestRunner_ioctl-tester       FAIL      13.13 seconds
TestRunner_mesh-tester        PASS      10.25 seconds
TestRunner_smp-tester         PASS      10.93 seconds
TestRunner_userchan-tester    PASS      8.58 seconds
IncrementalBuild              PASS      41.29 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: Fix double free in hci_conn_cleanup

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
4: B2 Line has trailing whitespace: "After releasing an object using hci_conn_del_sysfs in the "
5: B2 Line has trailing whitespace: "hci_conn_cleanup function, releasing the same object again "
28: B2 Line has trailing whitespace: "This patch drop the hci_dev_put and hci_conn_put function "
29: B2 Line has trailing whitespace: "call in hci_conn_cleanup function, because the object is "
32: B1 Line exceeds max length (87>80): "Link: https://syzkaller.appspot.com/bug?id=1bb51491ca5df96a5f724899d1dbb87afda61419 [1]"
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 494, Passed: 489 (99.0%), Failed: 5, Not Run: 0

Failed Test Cases
Read Ext Controller Info 1                           Failed       0.168 seconds
Read Ext Controller Info 2                           Failed       0.196 seconds
Read Ext Controller Info 3                           Failed       0.172 seconds
Read Ext Controller Info 4                           Failed       0.184 seconds
Read Ext Controller Info 5                           Failed       0.220 seconds
##############################
Test: TestRunner_ioctl-tester - FAIL
Desc: Run ioctl-tester with test-runner
Output:
No test result found


---
Regards,
Linux Bluetooth

Patch

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index acf563fbdfd9..a0ccbef34bc2 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -152,10 +152,6 @@  static void hci_conn_cleanup(struct hci_conn *conn)
 	hci_conn_del_sysfs(conn);
 
 	debugfs_remove_recursive(conn->debugfs);
-
-	hci_dev_put(hdev);
-
-	hci_conn_put(conn);
 }
 
 static void le_scan_cleanup(struct work_struct *work)