Re: Re: [PATCH] Bluetooth: rfcomm: Fix null-ptr-deref in

[Yuxuan-Hu]

Hi Luiz,

I apologize for sending too many emails and causing any inconvenience. 
However, I forgot to add the CC List in the previous email, and there 
was something wrong with the version change description in the 
previously submitted V2 patch. Therefore, I have now submitted the patch 
again. I sincerely apologize for any inconvenience caused.

I have attempted to fix this bug using the method you described in your 
response. After our testing, we have confirmed that this method is 
effective, and now the KASAN will not be triggered. I have submitted a 
new version of the patch.

https://patchwork.kernel.org/project/bluetooth/patch/20240103040611.3279681-1-20373622@xxxxxxxxxxx/

Thank you once again, and I sincerely look forward to your response.

On 2024/1/3 1:02, Luiz Augusto von Dentz wrote:
> Hi Yuxuan,
>
> On Tue, Dec 26, 2023 at 2:40 AM Yuxuan Hu <20373622@xxxxxxxxxxx> wrote:
> > During our fuzz testing of the connection and disconnection process at the
> > RFCOMM layer,we discovered this bug.By comparing the packetsfrom a normal
> > connection and disconnection process with the testcase that triggered a
> > KASAN report, we analyzed the cause of this bug as follows:
> >
> > 1. In the packets captured during a normal connection, the host sends a
> > `Read Encryption Key Size` type of `HCI_CMD` packet(Command Opcode: 0x1408)
> > to the controller to inquire the length of encryption key.After receiving
> > this packet, the controller immediately replies with a Command Complete
> > packet (Event Code: 0x0e) to return the Encryption Key Size.
> >
> > 2. In our fuzz test case, the timing of the controller's response to this
> > packet was delayed to an unexpected point: after the RFCOMM and L2CAP
> > layers had disconnected but before the HCI layer had disconnected.
> >
> > 3. After receiving the Encryption Key Size Response at the time described
> > in point 2, the host still called the rfcomm_check_security function.
> > However, by this time `struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;`
> > had already been released, and when the function executed
> > `return hci_conn_security(conn->hcon, d->sec_level, auth_type, d->out);`,
> > specifically when accessing `conn->hcon`, a null-ptr-deref error occurred.
> >
> > Adding a check for whether `conn` is a null pointer to fix this bug.
> >
> > Signed-off-by: Yuxuan Hu <20373622@xxxxxxxxxxx>
> > ---
> >   net/bluetooth/rfcomm/core.c | 3 +++
> >   1 file changed, 3 insertions(+)
> >
> > diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
> > index 053ef8f25fae..5ffa197fdb48 100644
> > --- a/net/bluetooth/rfcomm/core.c
> > +++ b/net/bluetooth/rfcomm/core.c
> > @@ -228,6 +228,9 @@ static int rfcomm_check_security(struct rfcomm_dlc *d)
> >                  auth_type = HCI_AT_NO_BONDING;
> >                  break;
> >          }
> > +
> > +       if (!conn)
> > +               return 0;
> This shall probably be handled earlier, perhaps on rfcomm_process_rx
> if we can check that had been disconnected, that way we drop packets
> that we know don't have any effect since later we do call
> rfcomm_session_close e.g:
>
> diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
> index 053ef8f25fae..1d34d8497033 100644
> --- a/net/bluetooth/rfcomm/core.c
> +++ b/net/bluetooth/rfcomm/core.c
> @@ -1941,7 +1941,7 @@ static struct rfcomm_session
> *rfcomm_process_rx(struct rfcomm_session *s)
>          /* Get data directly from socket receive queue without copying it. */
>          while ((skb = skb_dequeue(&sk->sk_receive_queue))) {
>                  skb_orphan(skb);
> -               if (!skb_linearize(skb)) {
> +               if (!skb_linearize(skb) && sk->sk_state != BT_CLOSED) {
>                          s = rfcomm_recv_frame(s, skb);
>                          if (!s)
>                                  break;