Linux Kernel Bluetooth slab-use-after-free in hci_sync.c: Root Cause & Fix Analysis

Vulnerability Overview Vulnerability Type: (heap use-after-free) reported by KASAN Trigger Scenario: In , the function sends an HCI command while holding , whereas a concurrent call may free the current HCI entry while the controller is waiting, resulting in a race condition. Root Cause: executes under , but can free the entry while the controller is waiting, leading to a use-after-free. Impact Scope Affected File: Affected Function: Impact: May cause kernel crashes or memory corruption, affecting the synchronization of the Bluetooth controller's event filter updates. Fix Details Fix Commit: Fix Description: has been rewritten to release the lock before sending the HCI command, thereby avoiding potentially blocking operations while the lock is held. Key Changes: - In , release before sending the HCI command. - In , release the lock before sending the HCI command, avoiding potentially blocking operations while the lock is held. POC/Exploit Code ```c // Key code snippet after the fix static int hci_update_event_filter_sync(struct hci_dev hdev) { struct l2cap_accept_list list; size_t i, num_entries = 0; u8 scan = SCAN_DISABLE; bool scanning = test_bit(HCI_FSCAN, &hdev->flags); for_each_entry(list, &hdev->accept_list, list) { if (!(list->flags & HCI_CONN_FLAG_REMOTE_WAKEUP) continue; hci_dev_unlock(hdev); if (!num_entries++) hci_dev_unlock(hdev); goto update_scan; } err = hci_set_event_filter_sync(hdev, HCI_FLT_CONN_SETUP, HCI_CONN_SETUP_ALLOW_BDADDR, &accept_list); if (!accept_list) { hci_dev_unlock(hdev); return -ENOMEM; } i = 0; for_each_entry(list, &hdev->accept_list, list) { if (!(list->flags & HCI_CONN_FLAG_REMOTE_WAKEUP) continue; hci_dev_unlock(hdev); if (!num_entries++) hci_dev_unlock(hdev); goto update_scan; } for (i = 0; i < num_entries; i++) { hci_dev_unlock(hdev); if (!num_entries++) hci_dev_unlock(hdev); goto update_scan; } err = hci_set_event_filter_sync(hdev, HCI_FLT_CONN_SETUP, HCI_CONN_SETUP_AUTO_ON, &accept_list); if (err) { bt_dev_dbg(hdev, "Failed to set event filter for %pMR", &accept_list[i]); hci_dev_unlock(hdev); goto update_scan; } update_scan: if (scan == SCANNING) hci_scan_enable_sync(hdev, scan); else if (scan == IDLE) hci_scan_enable_sync(hdev, scan); }

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel Bluetooth slab-use-after-free in hci_sync.c: Root Cause & Fix Analysis