Commit 23d22f2f authored by Raphael Pinsonneault-Thibeault's avatar Raphael Pinsonneault-Thibeault Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF 



There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.

Fix by moving the accesses to btusb data to before the data is free'd.

Reported-by: default avatar <syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b


Tested-by: default avatar <syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com>
Fixes: fd913ef7 ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: default avatarRaphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 55fb52ff

drivers/bluetooth/btusb.c

+6 −7
Original line number Diff line number Diff line
@@ -4361,6 +4361,11 @@ static void btusb_disconnect(struct usb_interface *intf) 


	hci_unregister_dev(hdev);



	if (data->oob_wake_irq)

		device_init_wakeup(&data->udev->dev, false);

	if (data->reset_gpio)

		gpiod_put(data->reset_gpio);



	if (intf == data->intf) {

		if (data->isoc)

			usb_driver_release_interface(&btusb_driver, data->isoc);
@@ -4371,17 +4376,11 @@ static void btusb_disconnect(struct usb_interface *intf) 
			usb_driver_release_interface(&btusb_driver, data->diag);

		usb_driver_release_interface(&btusb_driver, data->intf);

	} else if (intf == data->diag) {

		usb_driver_release_interface(&btusb_driver, data->intf);

		if (data->isoc)

			usb_driver_release_interface(&btusb_driver, data->isoc);

		usb_driver_release_interface(&btusb_driver, data->intf);

	}



	if (data->oob_wake_irq)

		device_init_wakeup(&data->udev->dev, false);



	if (data->reset_gpio)

		gpiod_put(data->reset_gpio);



	hci_free_dev(hdev);

}