kernel/linux.git/net/bluetooth/msft.c, branch v6.1.168

Bluetooth: msft: fix slab-use-after-free in msft_do_close()

2024-05-17T09:56:11+00:00

[ Upstream commit 10f9f426ac6e752c8d87bf4346930ba347aaabac ] Tying the msft->data lifetime to hdev by freeing it in hci_release_dev() to fix the following case: [use] msft_do_close() msft = hdev->msft_data; if (!msft) ...(1) <- passed. return; mutex_lock(&msft->filter_lock); ...(4) <- used after freed. [free] msft_unregister() msft = hdev->msft_data; hdev->msft_data = NULL; ...(2) kfree(msft); ...(3) <- msft is freed. ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x8f/0xc30 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888106cbbca8 by task kworker/u5:2/309 Fixes: bf6a4e30ffbd ("Bluetooth: disable advertisement filters during suspend") Signed-off-by: Sungwoo Kim Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin

Bluetooth: Fix null pointer deref on unexpected status event

2022-08-09T00:04:37+00:00

__hci_cmd_sync returns NULL if the controller responds with a status event. This is unexpected for the commands sent here, but on occurrence leads to null pointer dereferences and thus must be handled. Signed-off-by: Soenke Huster Signed-off-by: Luiz Augusto von Dentz

Bluetooth: hci_sync: Refactor remove Adv Monitor

2022-07-22T00:14:55+00:00

Make use of hci_cmd_sync_queue for removing an advertisement monitor. Signed-off-by: Manish Mandlik Reviewed-by: Miao-chen Chou Signed-off-by: Luiz Augusto von Dentz

Bluetooth: hci_sync: Refactor add Adv Monitor

2022-07-22T00:14:32+00:00

Make use of hci_cmd_sync_queue for adding an advertisement monitor. Signed-off-by: Manish Mandlik Reviewed-by: Miao-chen Chou Signed-off-by: Luiz Augusto von Dentz

Bluetooth: msft: Clear tracked devices on resume

2022-03-18T16:12:08+00:00

Clear already tracked devices on system resume. Once the monitors are reregistered after resume, matched devices in range will be found again. Signed-off-by: Manish Mandlik Reviewed-by: Miao-chen Chou Signed-off-by: Marcel Holtmann

Bluetooth: msft: fix null pointer deref on msft_monitor_device_evt

2022-01-23T14:30:18+00:00

msft_find_handle_data returns NULL if it can't find the handle. Therefore, handle_data must be checked, otherwise a null pointer is dereferenced. Signed-off-by: Soenke Huster Signed-off-by: Marcel Holtmann

Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events

2022-01-20T21:10:28+00:00

This patch introduces two new MGMT events for notifying the bluetoothd whenever the controller starts/stops monitoring a device. Test performed: - Verified by logs that the MSFT Monitor Device is received from the controller and the bluetoothd is notified whenever the controller starts/stops monitoring a device. Signed-off-by: Manish Mandlik Reviewed-by: Miao-chen Chou Signed-off-by: Luiz Augusto von Dentz

Bluetooth: msft: Handle MSFT Monitor Device Event

2022-01-20T21:10:21+00:00

Whenever the controller starts/stops monitoring a bt device, it sends MSFT Monitor Device event. Add handler to read this vendor event. Test performed: - Verified by logs that the MSFT Monitor Device event is received from the controller whenever it starts/stops monitoring a device. Signed-off-by: Manish Mandlik Reviewed-by: Miao-chen Chou Signed-off-by: Luiz Augusto von Dentz

Bluetooth: hci_event: Use of a function table to handle HCI events

2021-12-07T16:05:50+00:00

This change the use of switch statement to a function table which is easier to extend and can include min/max length of each HCI event. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann

Bluetooth: hci_sync: Rework hci_suspend_notifier

2021-10-29T14:52:00+00:00

This makes hci_suspend_notifier use the hci_*_sync which can be executed synchronously which is allowed in the suspend_notifier and simplifies a lot of the handling since the status of each command can be checked inline so no other work need to be scheduled thus can be performed without using of a state machine. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann