CVE-2025-21969

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd

After the hci sync command releases l2capconn, the hci receive data work queue references the released l2capconn when sending to the upper layer. Add hci dev lock to the hci receive data work queue to synchronize the two.

[1] BUG: KASAN: slab-use-after-free in l2capsendcmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837

CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci1 hcirxwork Call Trace: <TASK> _dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0x169/0x550 mm/kasan/report.c:489 kasanreport+0x143/0x180 mm/kasan/report.c:602 l2capbuildcmd net/bluetooth/l2capcore.c:2964 [inline] l2capsendcmd+0x187/0x8d0 net/bluetooth/l2capcore.c:954 l2capsigsendrej net/bluetooth/l2capcore.c:5502 [inline] l2capsigchannel net/bluetooth/l2capcore.c:5538 [inline] l2caprecvframe+0x221f/0x10db0 net/bluetooth/l2capcore.c:6817 hciacldatapacket net/bluetooth/hcicore.c:3797 [inline] hcirxwork+0x508/0xdb0 net/bluetooth/hcicore.c:4040 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa66/0x1840 kernel/workqueue.c:3310 workerthread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK>

Allocated by task 5837: kasansavestack mm/kasan/common.c:47 [inline] kasansavetrack+0x3f/0x80 mm/kasan/common.c:68 poisonkmallocredzone mm/kasan/common.c:377 [inline] _kasankmalloc+0x98/0xb0 mm/kasan/common.c:394 kasankmalloc include/linux/kasan.h:260 [inline] _kmalloccachenoprof+0x243/0x390 mm/slub.c:4329 kmallocnoprof include/linux/slab.h:901 [inline] kzallocnoprof include/linux/slab.h:1037 [inline] l2capconnadd+0xa9/0x8e0 net/bluetooth/l2capcore.c:6860 l2capconnectcfm+0x115/0x1090 net/bluetooth/l2capcore.c:7239 hciconnectcfm include/net/bluetooth/hcicore.h:2057 [inline] hciremotefeaturesevt+0x68e/0xac0 net/bluetooth/hcievent.c:3726 hcieventfunc net/bluetooth/hcievent.c:7473 [inline] hcieventpacket+0xac2/0x1540 net/bluetooth/hcievent.c:7525 hcirxwork+0x3f3/0xdb0 net/bluetooth/hcicore.c:4035 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa66/0x1840 kernel/workqueue.c:3310 workerthread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Freed by task 54: kasansavestack mm/kasan/common.c:47 [inline] kasansavetrack+0x3f/0x80 mm/kasan/common.c:68 kasansavefreeinfo+0x40/0x50 mm/kasan/generic.c:582 poisonslabobject mm/kasan/common.c:247 [inline] _kasanslabfree+0x59/0x70 mm/kasan/common.c:264 kasanslabfree include/linux/kasan.h:233 [inline] slabfreehook mm/slub.c:2353 [inline] slabfree mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2capconnectcfm+0xcc/0x1090 net/bluetooth/l2capcore.c:7235 hciconnectcfm include/net/bluetooth/hcicore.h:2057 [inline] hciconnfailed+0x287/0x400 net/bluetooth/hciconn.c:1266 hciabortconnsync+0x56c/0x11f0 net/bluetooth/hcisync.c:5603 hcicmdsyncwork+0x22b/0x400 net/bluetooth/hcisync.c:332 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xa66/0x1840 kernel/workqueue.c:3310 workerthread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entr ---truncated---