From nobody Fri Jul 24 23:30:47 2026 Received: from mailgw.kylinos.cn (mailgw.kylinos.cn [124.126.103.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A5083E556B; Wed, 22 Jul 2026 08:31:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=124.126.103.232 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784709107; cv=none; b=FLITnM19l11Cp34vG9VcsvT2zR1SVHytiQz0iyFQJl0A2PUXggUzq69WVNav4Aq3elnkpm3pD/cVVOascgVVcOw5JzdF3USb01Sh8JY5+XeHXPv2rLlx48AObq7IjEPh5kYzeMkLm+f08YC47pvd2mJPnWmZi/ikAioVw2DYb4E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784709107; c=relaxed/simple; bh=Flp6Ch4Lz/xGopy8Xp5tG0XHEEwjMSF/AQaI2Qf2P+0=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=SShK+KiQPlVNVklGtSJz0PABCzR2hgButi7PmLlFOxGjKTRuuJjmtcmLHx8+JDIi6cp/OlC0KjPtw8NuEnVfin7czZxYZVZ+3G1YjNEzktsDpyVo37Y1KXzazojUUMRAV+UNFiNI4hXbTDVPj7aBuaze+iSb/HQ0xWH4Ayjr65g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn; spf=pass smtp.mailfrom=kylinos.cn; arc=none smtp.client-ip=124.126.103.232 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinos.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinos.cn X-UUID: c29f836885a711f1aa26b74ffac11d73-20260722 X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.3.12,REQID:e55cf362-8fe5-4627-8564-39815fc53c7c,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:e7bac3a,CLOUDID:e2e528d7525466bfc67c6ebf5e2d9f3a,BulkI D:nil,BulkQuantity:0,Recheck:0,SF:102|136|850|865|898,TC:nil,Content:0|15| 50,EDM:-3,IP:nil,URL:0,File:nil,RT:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0 ,OSA:0,AV:0,LES:1,SPR:NO,DKR:0,DKP:0,BRR:0,BRE:0,ARC:0 X-CID-BVR: 2,SSN|SDN X-CID-BAS: 2,SSN|SDN,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR X-CID-RHF: D41D8CD98F00B204E9800998ECF8427E X-UUID: c29f836885a711f1aa26b74ffac11d73-20260722 X-User: chenchangcheng@kylinos.cn Received: from localhost.localdomain [(10.44.16.150)] by mailgw.kylinos.cn (envelope-from ) (Generic MTA with TLSv1.3 TLS_AES_256_GCM_SHA384 256/256) with ESMTP id 2106482765; Wed, 22 Jul 2026 16:31:39 +0800 From: Chen Changcheng To: marcel@holtmann.org, luiz.dentz@gmail.com Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, ccc194101@163.com, Chen Changcheng Subject: [PATCH] Bluetooth: btrsi: Move set_bt_context after successful HCI registration Date: Wed, 22 Jul 2026 16:31:36 +0800 Message-Id: <20260722083136.175650-1-chenchangcheng@kylinos.cn> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In rsi_hci_attach(), ops->set_bt_context() stores the newly allocated h_adapter into common->bt_adapter before hci_alloc_dev() and hci_register_dev() are called. If either of these fails, h_adapter is freed but common->bt_adapter remains a non-NULL dangling pointer. This causes a deterministically reachable use-after-free when the device operates in a BT+WiFi coexistence mode and CONFIG_RSI_COEX is enabled. The following software-only trigger paths exist: 1. SDIO driver .remove (rsi_disconnect) 2. USB driver .disconnect (rsi_disconnect) 3. SDIO driver .shutdown (rsi_shutdown) 4. Hibernation .freeze (rsi_freeze) All four paths check: if (IS_ENABLED(CONFIG_RSI_COEX) && coex_mode > 1 && bt_adapter) rsi_bt_ops.detach(bt_adapter); // use-after-free coex_mode is set during rsi_91x_init(), before rsi_hci_attach() is called, and is not cleared on attach failure. Since set_bt_context() already wrote bt_adapter before the failure, the deinit paths see a non-NULL dangling pointer and proceed to detach it. Fix this by moving set_bt_context() after hci_register_dev() succeeds. On failure paths bt_adapter stays NULL, and the deinit callers correctly skip the detach call. Signed-off-by: Chen Changcheng --- drivers/bluetooth/btrsi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btrsi.c b/drivers/bluetooth/btrsi.c index 59ad0b9b14c3..3f802b7c83f7 100644 --- a/drivers/bluetooth/btrsi.c +++ b/drivers/bluetooth/btrsi.c @@ -107,7 +107,6 @@ static int rsi_hci_attach(void *priv, struct rsi_proto_= ops *ops) return -ENOMEM; =20 h_adapter->priv =3D priv; - ops->set_bt_context(priv, h_adapter); h_adapter->proto_ops =3D ops; =20 hdev =3D hci_alloc_dev(); @@ -136,6 +135,8 @@ static int rsi_hci_attach(void *priv, struct rsi_proto_= ops *ops) goto err; } =20 + ops->set_bt_context(priv, h_adapter); + return 0; err: h_adapter->hdev =3D NULL; --=20 2.25.1