[PW_SID:1101233] [v2] Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync by BluezTestBot · Pull Request #247 · bluez/bluetooth-next

BluezTestBot · 2026-05-26T21:20:33Z

hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing
both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was
obtained from an RCU-protected iteration over hdev->conn_hash.list and
is not valid once these locks are dropped. A concurrent disconnect can
free the hci_conn between the unlock and the dereference, causing a
use-after-free read.

The cancellation mechanism in hci_conn_del() cannot prevent this because
hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL:

hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL);

While hci_conn_del() dequeues with data=conn:

hci_cmd_sync_dequeue(hdev, NULL, conn, NULL);

Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never
matches, and the pending work item is not cancelled.

Fix this by saving conn->conn_timeout into a local variable while the
locks are still held, so the stale conn pointer is never dereferenced
after unlock.

This is the same class of bug as the one fixed by commit
035c250 ("Bluetooth: hci_sync: Fix UAF in
le_read_features_complete") which addressed the identical pattern in a
different function.

Found by 0sec (https://0sec.ai) using automated source analysis.

Fixes: `c09b80b` ("Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED")
Cc: stable@vger.kernel.org
Reported-by: Doruk Tan Ozturk doruk@0sec.ai
Closes: https://lore.kernel.org/linux-bluetooth/20260525162438.96881-1-doruk@0sec.ai/
Signed-off-by: Doruk Tan Ozturk doruk@0sec.ai

v2:

fix commit reference title ("Fix UAF in" not "Fix UAF on")
fix Fixes: tag title to match actual commit
add Closes: tag per checkpatch

Link: https://lore.kernel.org/linux-bluetooth/20260525162438.96881-1-doruk@0sec.ai/

net/bluetooth/hci_sync.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

--
2.45.0

hci_le_create_cis_sync() dereferences conn->conn_timeout after releasing both rcu_read_lock() and hci_dev_lock(hdev). The conn pointer was obtained from an RCU-protected iteration over hdev->conn_hash.list and is not valid once these locks are dropped. A concurrent disconnect can free the hci_conn between the unlock and the dereference, causing a use-after-free read. The cancellation mechanism in hci_conn_del() cannot prevent this because hci_le_create_cis_pending() queues hci_create_cis_sync with data=NULL: hci_cmd_sync_queue(hdev, hci_create_cis_sync, NULL, NULL); While hci_conn_del() dequeues with data=conn: hci_cmd_sync_dequeue(hdev, NULL, conn, NULL); Since NULL != conn, the lookup in _hci_cmd_sync_lookup_entry() never matches, and the pending work item is not cancelled. Fix this by saving conn->conn_timeout into a local variable while the locks are still held, so the stale conn pointer is never dereferenced after unlock. This is the same class of bug as the one fixed by commit 035c250 ("Bluetooth: hci_sync: Fix UAF in le_read_features_complete") which addressed the identical pattern in a different function. Found by 0sec (https://0sec.ai) using automated source analysis. Fixes: c09b80b ("Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED") Cc: stable@vger.kernel.org Reported-by: Doruk Tan Ozturk <doruk@0sec.ai> Closes: https://lore.kernel.org/linux-bluetooth/20260525162438.96881-1-doruk@0sec.ai/ Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>

github-actions · 2026-05-26T21:33:20Z

CheckPatch
Desc: Run checkpatch.pl script
Duration: 0.57 seconds
Result: FAIL
Output:

[v2] Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync
ERROR: Please use git commit description style 'commit <12+ chars of sha1> ("<title line>")' - ie: 'commit 035c25007c9e ("Bluetooth: hci_sync: Fix UAF in le_read_features_complete")'
#121: 
This is the same class of bug as the one fixed by commit

total: 1 errors, 0 warnings, 0 checks, 22 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/patch/14596093.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.

github-actions · 2026-05-26T21:33:22Z

VerifyFixes
Desc: Verify Fixes tag format and validity
Duration: 0.08 seconds
Result: PASS

github-actions · 2026-05-26T21:33:24Z

VerifySignedoff
Desc: Verify Signed-off-by chain
Duration: 0.07 seconds
Result: PASS

github-actions · 2026-05-26T21:33:27Z

GitLint
Desc: Run gitlint
Duration: 0.50 seconds
Result: PASS

github-actions · 2026-05-26T21:33:29Z

SubjectPrefix
Desc: Check subject contains "Bluetooth" prefix
Duration: 0.07 seconds
Result: PASS

github-actions · 2026-05-26T21:34:03Z

BuildKernel
Desc: Build Kernel for Bluetooth
Duration: 27.63 seconds
Result: PASS

github-actions · 2026-05-26T21:34:39Z

CheckAllWarning
Desc: Run linux kernel with all warning enabled
Duration: 29.79 seconds
Result: PASS

github-actions · 2026-05-26T21:35:13Z

CheckSparse
Desc: Run sparse tool with linux kernel
Duration: 27.65 seconds
Result: PASS

github-actions · 2026-05-26T21:35:45Z

BuildKernel32
Desc: Build 32bit Kernel for Bluetooth
Duration: 25.96 seconds
Result: PASS

github-actions · 2026-05-26T21:45:24Z

TestRunnerSetup
Desc: Setup kernel and bluez for test-runner
Duration: 576.60 seconds
Result: PASS

github-actions · 2026-05-26T21:46:27Z

TestRunner_l2cap-tester
Desc: Run l2cap-tester with test-runner
Duration: 60.69 seconds
Result: PASS

github-actions · 2026-05-26T21:47:52Z

TestRunner_iso-tester
Desc: Run iso-tester with test-runner
Duration: 82.77 seconds
Result: PASS

github-actions · 2026-05-26T21:48:14Z

TestRunner_bnep-tester
Desc: Run bnep-tester with test-runner
Duration: 20.17 seconds
Result: PASS

github-actions · 2026-05-26T21:52:02Z

TestRunner_mgmt-tester
Desc: Run mgmt-tester with test-runner
Duration: 225.21 seconds
Result: FAIL
Output:

Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.271 seconds

github-actions · 2026-05-26T21:52:31Z

TestRunner_rfcomm-tester
Desc: Run rfcomm-tester with test-runner
Duration: 26.55 seconds
Result: PASS

github-actions · 2026-05-26T21:53:07Z

TestRunner_sco-tester
Desc: Run sco-tester with test-runner
Duration: 33.64 seconds
Result: PASS

github-actions · 2026-05-26T21:53:35Z

TestRunner_ioctl-tester
Desc: Run ioctl-tester with test-runner
Duration: 26.47 seconds
Result: PASS

github-actions · 2026-05-26T21:54:04Z

TestRunner_mesh-tester
Desc: Run mesh-tester with test-runner
Duration: 25.88 seconds
Result: FAIL
Output:

Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    1.993 seconds
Mesh - Send cancel - 2                               Timed out    1.989 seconds

github-actions · 2026-05-26T21:54:30Z

TestRunner_smp-tester
Desc: Run smp-tester with test-runner
Duration: 23.88 seconds
Result: PASS

github-actions · 2026-05-26T21:54:53Z

TestRunner_userchan-tester
Desc: Run userchan-tester with test-runner
Duration: 20.88 seconds
Result: PASS

github-actions · 2026-05-26T21:55:18Z

TestRunner_6lowpan-tester
Desc: Run 6lowpan-tester with test-runner
Duration: 23.41 seconds
Result: PASS

github-actions · 2026-05-26T21:55:28Z

IncrementalBuild
Desc: Incremental build with the patches in the series
Duration: 4.17 seconds
Result: FAIL
Output:


error: patch failed: net/bluetooth/hci_sync.c:6700
error: net/bluetooth/hci_sync.c: patch does not apply
hint: Use 'git am --show-current-patch' to see the failed patch

github-actions Bot added the area:hci label May 26, 2026

Conversation

BluezTestBot commented May 26, 2026

Fixes: c09b80b ("Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED") Cc: stable@vger.kernel.org Reported-by: Doruk Tan Ozturk doruk@0sec.ai Closes: https://lore.kernel.org/linux-bluetooth/20260525162438.96881-1-doruk@0sec.ai/ Signed-off-by: Doruk Tan Ozturk doruk@0sec.ai

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Fixes: `c09b80b` ("Bluetooth: hci_conn: Fix not waiting for HCI_EVT_LE_CIS_ESTABLISHED")
Cc: stable@vger.kernel.org
Reported-by: Doruk Tan Ozturk doruk@0sec.ai
Closes: https://lore.kernel.org/linux-bluetooth/20260525162438.96881-1-doruk@0sec.ai/
Signed-off-by: Doruk Tan Ozturk doruk@0sec.ai