Skip to content

Commit 8cad5b9

Browse files
Vudentzmehmetb0
Vudentz
authored and
mehmetb0
committed
Bluetooth: hci_core: Fix sleeping function called from invalid context
BugLink: https://bugs.launchpad.net/bugs/2097738 [ Upstream commit 4d94f05 ] This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs like the bellow: BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2 preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 4 locks held by kworker/u9:2/5070: #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915 CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: hci0 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline] hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939 hci_event_func net/bluetooth/hci_event.c:7514 [inline] hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 </TASK> Reported-by: [email protected] Tested-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614 Signed-off-by: Luiz Augusto von Dentz <[email protected]> Signed-off-by: Sasha Levin <[email protected]> CVE-2024-57894 Signed-off-by: Koichiro Den <[email protected]>
1 parent 421e24f commit 8cad5b9

File tree

6 files changed

+97
-57
lines changed

6 files changed

+97
-57
lines changed

‎include/net/bluetooth/hci_core.h

Lines changed: 70 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -804,7 +804,6 @@ struct hci_conn_params {
804804
extern struct list_head hci_dev_list;
805805
extern struct list_head hci_cb_list;
806806
extern rwlock_t hci_dev_list_lock;
807-
extern struct mutex hci_cb_list_lock;
808807

809808
#define hci_dev_set_flag(hdev, nr) set_bit((nr), (hdev)->dev_flags)
810809
#define hci_dev_clear_flag(hdev, nr) clear_bit((nr), (hdev)->dev_flags)
@@ -2007,68 +2006,103 @@ struct hci_cb {
20072006

20082007
char *name;
20092008

2009+
bool (*match) (struct hci_conn *conn);
20102010
void (*connect_cfm) (struct hci_conn *conn, __u8 status);
20112011
void (*disconn_cfm) (struct hci_conn *conn, __u8 status);
20122012
void (*security_cfm) (struct hci_conn *conn, __u8 status,
2013-
__u8 encrypt);
2013+
__u8 encrypt);
20142014
void (*key_change_cfm) (struct hci_conn *conn, __u8 status);
20152015
void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role);
20162016
};
20172017

2018+
static inline void hci_cb_lookup(struct hci_conn *conn, struct list_head *list)
2019+
{
2020+
struct hci_cb *cb, *cpy;
2021+
2022+
rcu_read_lock();
2023+
list_for_each_entry_rcu(cb, &hci_cb_list, list) {
2024+
if (cb->match && cb->match(conn)) {
2025+
cpy = kmalloc(sizeof(*cpy), GFP_ATOMIC);
2026+
if (!cpy)
2027+
break;
2028+
2029+
*cpy = *cb;
2030+
INIT_LIST_HEAD(&cpy->list);
2031+
list_add_rcu(&cpy->list, list);
2032+
}
2033+
}
2034+
rcu_read_unlock();
2035+
}
2036+
20182037
static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
20192038
{
2020-
struct hci_cb *cb;
2039+
struct list_head list;
2040+
struct hci_cb *cb, *tmp;
2041+
2042+
INIT_LIST_HEAD(&list);
2043+
hci_cb_lookup(conn, &list);
20212044

2022-
mutex_lock(&hci_cb_list_lock);
2023-
list_for_each_entry(cb, &hci_cb_list, list) {
2045+
list_for_each_entry_safe(cb, tmp, &list, list) {
20242046
if (cb->connect_cfm)
20252047
cb->connect_cfm(conn, status);
2048+
kfree(cb);
20262049
}
2027-
mutex_unlock(&hci_cb_list_lock);
20282050

20292051
if (conn->connect_cfm_cb)
20302052
conn->connect_cfm_cb(conn, status);
20312053
}
20322054

20332055
static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason)
20342056
{
2035-
struct hci_cb *cb;
2057+
struct list_head list;
2058+
struct hci_cb *cb, *tmp;
2059+
2060+
INIT_LIST_HEAD(&list);
2061+
hci_cb_lookup(conn, &list);
20362062

2037-
mutex_lock(&hci_cb_list_lock);
2038-
list_for_each_entry(cb, &hci_cb_list, list) {
2063+
list_for_each_entry_safe(cb, tmp, &list, list) {
20392064
if (cb->disconn_cfm)
20402065
cb->disconn_cfm(conn, reason);
2066+
kfree(cb);
20412067
}
2042-
mutex_unlock(&hci_cb_list_lock);
20432068

20442069
if (conn->disconn_cfm_cb)
20452070
conn->disconn_cfm_cb(conn, reason);
20462071
}
20472072

2048-
static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
2073+
static inline void hci_security_cfm(struct hci_conn *conn, __u8 status,
2074+
__u8 encrypt)
20492075
{
2050-
struct hci_cb *cb;
2051-
__u8 encrypt;
2052-
2053-
if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2054-
return;
2076+
struct list_head list;
2077+
struct hci_cb *cb, *tmp;
20552078

2056-
encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00;
2079+
INIT_LIST_HEAD(&list);
2080+
hci_cb_lookup(conn, &list);
20572081

2058-
mutex_lock(&hci_cb_list_lock);
2059-
list_for_each_entry(cb, &hci_cb_list, list) {
2082+
list_for_each_entry_safe(cb, tmp, &list, list) {
20602083
if (cb->security_cfm)
20612084
cb->security_cfm(conn, status, encrypt);
2085+
kfree(cb);
20622086
}
2063-
mutex_unlock(&hci_cb_list_lock);
20642087

20652088
if (conn->security_cfm_cb)
20662089
conn->security_cfm_cb(conn, status);
20672090
}
20682091

2092+
static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
2093+
{
2094+
__u8 encrypt;
2095+
2096+
if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
2097+
return;
2098+
2099+
encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00;
2100+
2101+
hci_security_cfm(conn, status, encrypt);
2102+
}
2103+
20692104
static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
20702105
{
2071-
struct hci_cb *cb;
20722106
__u8 encrypt;
20732107

20742108
if (conn->state == BT_CONFIG) {
@@ -2095,40 +2129,38 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
20952129
conn->sec_level = conn->pending_sec_level;
20962130
}
20972131

2098-
mutex_lock(&hci_cb_list_lock);
2099-
list_for_each_entry(cb, &hci_cb_list, list) {
2100-
if (cb->security_cfm)
2101-
cb->security_cfm(conn, status, encrypt);
2102-
}
2103-
mutex_unlock(&hci_cb_list_lock);
2104-
2105-
if (conn->security_cfm_cb)
2106-
conn->security_cfm_cb(conn, status);
2132+
hci_security_cfm(conn, status, encrypt);
21072133
}
21082134

21092135
static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
21102136
{
2111-
struct hci_cb *cb;
2137+
struct list_head list;
2138+
struct hci_cb *cb, *tmp;
2139+
2140+
INIT_LIST_HEAD(&list);
2141+
hci_cb_lookup(conn, &list);
21122142

2113-
mutex_lock(&hci_cb_list_lock);
2114-
list_for_each_entry(cb, &hci_cb_list, list) {
2143+
list_for_each_entry_safe(cb, tmp, &list, list) {
21152144
if (cb->key_change_cfm)
21162145
cb->key_change_cfm(conn, status);
2146+
kfree(cb);
21172147
}
2118-
mutex_unlock(&hci_cb_list_lock);
21192148
}
21202149

21212150
static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
21222151
__u8 role)
21232152
{
2124-
struct hci_cb *cb;
2153+
struct list_head list;
2154+
struct hci_cb *cb, *tmp;
2155+
2156+
INIT_LIST_HEAD(&list);
2157+
hci_cb_lookup(conn, &list);
21252158

2126-
mutex_lock(&hci_cb_list_lock);
2127-
list_for_each_entry(cb, &hci_cb_list, list) {
2159+
list_for_each_entry_safe(cb, tmp, &list, list) {
21282160
if (cb->role_switch_cfm)
21292161
cb->role_switch_cfm(conn, status, role);
2162+
kfree(cb);
21302163
}
2131-
mutex_unlock(&hci_cb_list_lock);
21322164
}
21332165

21342166
static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)

‎net/bluetooth/hci_core.c

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,6 @@ DEFINE_RWLOCK(hci_dev_list_lock);
5757

5858
/* HCI callback list */
5959
LIST_HEAD(hci_cb_list);
60-
DEFINE_MUTEX(hci_cb_list_lock);
6160

6261
/* HCI ID Numbering */
6362
static DEFINE_IDA(hci_index_ida);
@@ -2993,9 +2992,7 @@ int hci_register_cb(struct hci_cb *cb)
29932992
{
29942993
BT_DBG("%p name %s", cb, cb->name);
29952994

2996-
mutex_lock(&hci_cb_list_lock);
2997-
list_add_tail(&cb->list, &hci_cb_list);
2998-
mutex_unlock(&hci_cb_list_lock);
2995+
list_add_tail_rcu(&cb->list, &hci_cb_list);
29992996

30002997
return 0;
30012998
}
@@ -3005,9 +3002,8 @@ int hci_unregister_cb(struct hci_cb *cb)
30053002
{
30063003
BT_DBG("%p name %s", cb, cb->name);
30073004

3008-
mutex_lock(&hci_cb_list_lock);
3009-
list_del(&cb->list);
3010-
mutex_unlock(&hci_cb_list_lock);
3005+
list_del_rcu(&cb->list);
3006+
synchronize_rcu();
30113007

30123008
return 0;
30133009
}

‎net/bluetooth/iso.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2137,6 +2137,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
21372137
return HCI_LM_ACCEPT;
21382138
}
21392139

2140+
static bool iso_match(struct hci_conn *hcon)
2141+
{
2142+
return hcon->type == ISO_LINK || hcon->type == LE_LINK;
2143+
}
2144+
21402145
static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)
21412146
{
21422147
if (hcon->type != ISO_LINK) {
@@ -2318,6 +2323,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
23182323

23192324
static struct hci_cb iso_cb = {
23202325
.name = "ISO",
2326+
.match = iso_match,
23212327
.connect_cfm = iso_connect_cfm,
23222328
.disconn_cfm = iso_disconn_cfm,
23232329
};

‎net/bluetooth/l2cap_core.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7217,16 +7217,18 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
72177217
return NULL;
72187218
}
72197219

7220+
static bool l2cap_match(struct hci_conn *hcon)
7221+
{
7222+
return hcon->type == ACL_LINK || hcon->type == LE_LINK;
7223+
}
7224+
72207225
static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
72217226
{
72227227
struct hci_dev *hdev = hcon->hdev;
72237228
struct l2cap_conn *conn;
72247229
struct l2cap_chan *pchan;
72257230
u8 dst_type;
72267231

7227-
if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7228-
return;
7229-
72307232
BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
72317233

72327234
if (status) {
@@ -7291,9 +7293,6 @@ int l2cap_disconn_ind(struct hci_conn *hcon)
72917293

72927294
static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
72937295
{
7294-
if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7295-
return;
7296-
72977296
BT_DBG("hcon %p reason %d", hcon, reason);
72987297

72997298
l2cap_conn_del(hcon, bt_to_errno(reason));
@@ -7572,6 +7571,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
75727571

75737572
static struct hci_cb l2cap_cb = {
75747573
.name = "L2CAP",
7574+
.match = l2cap_match,
75757575
.connect_cfm = l2cap_connect_cfm,
75767576
.disconn_cfm = l2cap_disconn_cfm,
75777577
.security_cfm = l2cap_security_cfm,

‎net/bluetooth/rfcomm/core.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2134,6 +2134,11 @@ static int rfcomm_run(void *unused)
21342134
return 0;
21352135
}
21362136

2137+
static bool rfcomm_match(struct hci_conn *hcon)
2138+
{
2139+
return hcon->type == ACL_LINK;
2140+
}
2141+
21372142
static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
21382143
{
21392144
struct rfcomm_session *s;
@@ -2180,6 +2185,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
21802185

21812186
static struct hci_cb rfcomm_cb = {
21822187
.name = "RFCOMM",
2188+
.match = rfcomm_match,
21832189
.security_cfm = rfcomm_security_cfm
21842190
};
21852191

‎net/bluetooth/sco.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1355,11 +1355,13 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
13551355
return lm;
13561356
}
13571357

1358-
static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1358+
static bool sco_match(struct hci_conn *hcon)
13591359
{
1360-
if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1361-
return;
1360+
return hcon->type == SCO_LINK || hcon->type == ESCO_LINK;
1361+
}
13621362

1363+
static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
1364+
{
13631365
BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
13641366

13651367
if (!status) {
@@ -1374,9 +1376,6 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
13741376

13751377
static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
13761378
{
1377-
if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
1378-
return;
1379-
13801379
BT_DBG("hcon %p reason %d", hcon, reason);
13811380

13821381
sco_conn_del(hcon, bt_to_errno(reason));
@@ -1402,6 +1401,7 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
14021401

14031402
static struct hci_cb sco_cb = {
14041403
.name = "SCO",
1404+
.match = sco_match,
14051405
.connect_cfm = sco_connect_cfm,
14061406
.disconn_cfm = sco_disconn_cfm,
14071407
};

0 commit comments

Comments
 (0)