From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DAD8014A60F for ; Sun, 28 Jun 2026 00:51:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782607906; cv=none; b=ikn3/7j318lpuhHuNvinIA/0WwqTNzoWcNVqm7d0ZLRAORuENvjJCxsOunJe+R3YhzMA1FoQyYKrQGzbcz3Lyp1Lc6SnHFdin/ChmzZN++n1lci0Mw3tAGssAaegWl8KTMjsLPQswRQmNNw/k91a8FEi2f+UPlHZn/k+JgvUFc8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782607906; c=relaxed/simple; bh=Mp9PKgXcdfrnu32zE0xG/md18n+XtX59fwt10nwDEm8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Pg+ddTROFTfBYqp7Ta50c9OMMoMUsNvoznsp9MPDjFEKNtSdFYFxfe0ioqo2ago9iUT+rMWlsH5XCTBZEyzZ+pgzTigTvV9/e3lTLe1WHMnbLhsyC5NTrwx0hebFykPdzd6JXGv24Sat0wzI6DUBCA+CWj6i0KfxjGbC7mRCEec= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=r7Kf9nbq; arc=none smtp.client-ip=209.85.221.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="r7Kf9nbq" Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-46ee68c3b7aso1745103f8f.3 for ; Sat, 27 Jun 2026 17:51:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782607902; x=1783212702; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=UPwdm7KkCwq7FXWIfhNWIbsHZGYDSUssRzVk4QB6Egs=; b=r7Kf9nbq5atKDQKyWca+BjVkF/sTa6Nk3DbwlMXrp9TCRR3hGbtlnRJ9y5ozX+SM55 12jdAFyMh8jJD8LSx358N7RwI+/YTFV5omK/NukFmelIb4hViNnqdCdtkqehhk7ID0Xi hvGxWGEszg4se1ZohRnsSJG7hh6ualbKYMQhhdLV3dVBDHaCMtKi1Be3+OMky5vU5SEP DvwSuVXitwYGT/P8Czw5Nk9s2Tx6GiDgND6vGqGNWAC6kFb7RJcKvLe3AOqdzHbOe6eG XXOjHUZpZEOd3+cKQ5gcsHc1xdDuyHWYJ2U+kssCT6kUAp0d6hPBAWhP7EBrnN1lkEEN kaQw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782607902; x=1783212702; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=UPwdm7KkCwq7FXWIfhNWIbsHZGYDSUssRzVk4QB6Egs=; b=YHseoW4r3OBUotoFVDGYFurF4ASrjxfxayWOOju4XxuyEQbnkUXLyHW4rRoPI7oRIU eBctKFOMvXN77SX2C8xPy3J8l9xOoM8iNIRLdTl0gmUiAXvEOdRz7lYwdYQvATsBbRDL pqccGM987M3YvxDRXMHOzE3svlgvZ8QBSh7b3iB1EDdyv4Q4HhSc+m/StImz6q+RGYrh qpR9U1i7D4clFHGUYyoFiX90tG4OxrIIDiWaPt/44ImcHqri1VqCWcDbAUzi3prXQuXQ Xai+fSg0PUFDmOvZkRqMA7HcgZuAQ2TvEdFvalb7OkGF+e+yKl+jsAyyGC4y78VgYchN +pmA== X-Forwarded-Encrypted: i=1; AFNElJ/7AClb1MLdFDlSrFRfu8DsrAd3ayRBToSIcYl+A6WmXTd/sfciG7zO4NTKEfgR4qGcc5ts0mQ3FTvsE7I=@vger.kernel.org X-Gm-Message-State: AOJu0YzCtwV1RAbGjzGkfthkY4esSsUd9q0WPmHLihmKr31I3TWGr1+E TpOmYlZS1XKP7x1PO5GeB+K0bUoKMoA+3518vaoEj+M03r8Ksqy0IPso X-Gm-Gg: AfdE7ckxVqol7doZkBM3LU9hD69D6zQCXqRLBVgQn0YA4PnsK1oyB8Ouw4yW/m2OkFA itqmIBgRq8SOAbtgVxm5dTiwcU9RBxtjufD758WIoX4xR6zAbfJ4P6UCd7a4qqjFgoyB0Ujpo8p gzrcxQzIDGMyrx6cNp4REeYyy6h0tNr6OkDfRyoc+IUkQVywebQ0s/yVB7YW5Fsf9QyS+F4VAFt QI+nhcbrHLksJRVLKgWMXgFZK1DIetQh1ECu0iphPPJtZ92dCntld4v9PYaMJNyEb7FJrG5VYN/ +829f+1ZxrE2dXONPMGxoCPHlxQ8uWOzELa9cdI+dCppqDEbZQ+IhXcEVevNqCcCikljulO4LEp 0NgPcd35P2LtBpbOU8LYRLaz6nH+SiPbOeJyZkLDYYJp7v3he/FmC4n+ZfmkqhIS6gojxopb5vR v7v2FdZ5ct2f416Kf6ChBC8R0uBw== X-Received: by 2002:a05:600c:4ed1:b0:492:6fea:969c with SMTP id 5b1f17b1804b1-4926fea982amr96709265e9.0.1782607902326; Sat, 27 Jun 2026 17:51:42 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4726b76e6f8sm4269078f8f.13.2026.06.27.17.51.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 Jun 2026 17:51:41 -0700 (PDT) From: Yousef Alhouseen To: Marcel Holtmann , Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] Bluetooth: bnep: pin L2CAP connection during netdev registration Date: Sun, 28 Jun 2026 02:50:58 +0200 Message-ID: <20260628005058.29072-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device. Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference. Fixes: 65f53e9802db ("Bluetooth: Access BNEP session addresses through L2CAP channel") Reported-by: syzbot+fed5dce4553262f3b35c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fed5dce4553262f3b35c Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- net/bluetooth/bnep/core.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c index add9a8f7535d..f7d88c33e23e 100644 --- a/net/bluetooth/bnep/core.c +++ b/net/bluetooth/bnep/core.c @@ -559,14 +559,18 @@ static int bnep_session(void *arg) return 0; } -static struct device *bnep_get_device(struct bnep_session *session) +static struct l2cap_conn *bnep_get_conn(struct bnep_session *session) { - struct l2cap_conn *conn = l2cap_pi(session->sock->sk)->chan->conn; + struct l2cap_chan *chan = l2cap_pi(session->sock->sk)->chan; + struct l2cap_conn *conn; - if (!conn || !conn->hcon) - return NULL; + l2cap_chan_lock(chan); + conn = chan->conn; + if (conn) + l2cap_conn_get(conn); + l2cap_chan_unlock(chan); - return &conn->hcon->dev; + return conn; } static const struct device_type bnep_type = { @@ -578,6 +582,7 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) u32 valid_flags = BIT(BNEP_SETUP_RESPONSE); struct net_device *dev; struct bnep_session *s, *ss; + struct l2cap_conn *conn = NULL; u8 dst[ETH_ALEN], src[ETH_ALEN]; int err; @@ -637,10 +642,18 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) bnep_set_default_proto_filter(s); #endif - SET_NETDEV_DEV(dev, bnep_get_device(s)); + conn = bnep_get_conn(s); + if (!conn) { + err = -ENOTCONN; + goto failed; + } + + SET_NETDEV_DEV(dev, &conn->hcon->dev); SET_NETDEV_DEVTYPE(dev, &bnep_type); err = register_netdev(dev); + l2cap_conn_put(conn); + conn = NULL; if (err) goto failed; @@ -662,6 +675,8 @@ int bnep_add_connection(struct bnep_connadd_req *req, struct socket *sock) return 0; failed: + if (conn) + l2cap_conn_put(conn); up_write(&bnep_session_sem); free_netdev(dev); return err; -- 2.54.0