• Luiz Augusto von Dentz's avatar
    Bluetooth: hci_conn: Fix crash on hci_create_cis_sync · 50757a25
    Luiz Augusto von Dentz authored
    When attempting to connect multiple ISO sockets without using
    DEFER_SETUP may result in the following crash:
    
    BUG: KASAN: null-ptr-deref in hci_create_cis_sync+0x18b/0x2b0
    Read of size 2 at addr 0000000000000036 by task kworker/u3:1/50
    
    CPU: 0 PID: 50 Comm: kworker/u3:1 Not tainted
    6.0.0-rc7-02243-gb84a13ff4eda #4373
    Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
    BIOS 1.16.0-1.fc36 04/01/2014
    Workqueue: hci0 hci_cmd_sync_work
    Call Trace:
     <TASK>
     dump_stack_lvl+0x19/0x27
     kasan_report+0xbc/0xf0
     ? hci_create_cis_sync+0x18b/0x2b0
     hci_create_cis_sync+0x18b/0x2b0
     ? get_link_mode+0xd0/0xd0
     ? __ww_mutex_lock_slowpath+0x10/0x10
     ? mutex_lock+0xe0/0xe0
     ? get_link_mode+0xd0/0xd0
     hci_cmd_sync_work+0x111/0x190
     process_one_work+0x427/0x650
     worker_thread+0x87/0x750
     ? process_one_work+0x650/0x650
     kthread+0x14e/0x180
     ? kthread_exit+0x50/0x50
     ret_from_fork+0x22/0x30
     </TASK>
    
    Fixes: 26afbd82 ("Bluetooth: Add initial implementation of CIS connections")
    Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
    50757a25
hci_conn.c 69.1 KB