|
 |
e91b83 |
From d50512e6312824861ce342eb68bb1eb7dea984e2 Mon Sep 17 00:00:00 2001
|
|
|
e91b83 |
From: Artem Savkov <asavkov@redhat.com>
|
|
|
e91b83 |
Date: Mon, 21 Jun 2021 12:09:28 +0200
|
|
|
e91b83 |
Subject: [PATCH] bluetooth: eliminate the potential race condition when
|
|
|
e91b83 |
removing the HCI controller
|
|
|
e91b83 |
|
|
|
e91b83 |
Kernels:
|
|
|
e91b83 |
4.18.0-305.el8
|
|
|
e91b83 |
4.18.0-305.3.1.el8_4
|
|
|
e91b83 |
4.18.0-305.7.1.el8_4
|
|
|
e91b83 |
|
|
|
e91b83 |
Changes since last build:
|
|
|
e91b83 |
[x86_64]:
|
|
|
e91b83 |
hci_request.o: changed function: hci_req_sync
|
|
|
e91b83 |
|
|
|
e91b83 |
[ppc64le]:
|
|
|
e91b83 |
hci_request.o: changed function: bg_scan_update
|
|
|
e91b83 |
hci_request.o: changed function: connectable_update_work
|
|
|
e91b83 |
hci_request.o: changed function: discov_off
|
|
|
e91b83 |
hci_request.o: changed function: discov_update
|
|
|
e91b83 |
hci_request.o: changed function: discoverable_update_work
|
|
|
e91b83 |
hci_request.o: changed function: hci_req_sync
|
|
|
e91b83 |
hci_request.o: changed function: le_scan_disable_work
|
|
|
e91b83 |
hci_request.o: changed function: le_scan_restart_work
|
|
|
e91b83 |
hci_request.o: changed function: scan_update_work
|
|
|
e91b83 |
|
|
|
e91b83 |
---------------------------
|
|
|
e91b83 |
|
|
|
e91b83 |
Kernels:
|
|
|
e91b83 |
4.18.0-305.el8
|
|
|
e91b83 |
4.18.0-305.3.1.el8_4
|
|
|
e91b83 |
4.18.0-305.7.1.el8_4
|
|
|
e91b83 |
|
|
|
e91b83 |
Modifications: none
|
|
|
e91b83 |
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-8/-/merge_requests/804
|
|
|
e91b83 |
|
|
|
e91b83 |
commit 84466ca3bdf0d5d77d4c8a851336406627de2628
|
|
|
e91b83 |
Author: Gopal Tiwari <gtiwari@redhat.com>
|
|
|
e91b83 |
Date: Mon Jun 14 13:47:30 2021 +0530
|
|
|
e91b83 |
|
|
|
e91b83 |
bluetooth: eliminate the potential race condition when removing the HCI controller
|
|
|
e91b83 |
|
|
|
e91b83 |
Bugzilla: https://bugzilla.redhat.com/1971464
|
|
|
e91b83 |
CVE: CVE-2021-32399
|
|
|
e91b83 |
Y-Commit: 54c81477df19422cbc3c8cf3b555159ff642f15b
|
|
|
e91b83 |
|
|
|
e91b83 |
O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1971488
|
|
|
e91b83 |
|
|
|
e91b83 |
Upstream: Merged
|
|
|
e91b83 |
|
|
|
e91b83 |
Testing: Sanity_only.
|
|
|
e91b83 |
|
|
|
e91b83 |
commit e2cb6b891ad2b8caa9131e3be70f45243df82a80
|
|
|
e91b83 |
Author: Lin Ma <linma@zju.edu.cn>
|
|
|
e91b83 |
Date: Mon Apr 12 19:17:57 2021 +0800
|
|
|
e91b83 |
|
|
|
e91b83 |
bluetooth: eliminate the potential race condition when removing the HCI controller
|
|
|
e91b83 |
|
|
|
e91b83 |
There is a possible race condition vulnerability between issuing a HCI
|
|
|
e91b83 |
command and removing the cont. Specifically, functions hci_req_sync()
|
|
|
e91b83 |
and hci_dev_do_close() can race each other like below:
|
|
|
e91b83 |
|
|
|
e91b83 |
thread-A in hci_req_sync() | thread-B in hci_dev_do_close()
|
|
|
e91b83 |
| hci_req_sync_lock(hdev);
|
|
|
e91b83 |
test_bit(HCI_UP, &hdev->flags); |
|
|
|
e91b83 |
... | test_and_clear_bit(HCI_UP, &hdev->flags)
|
|
|
e91b83 |
hci_req_sync_lock(hdev); |
|
|
|
e91b83 |
|
|
|
|
e91b83 |
In this commit we alter the sequence in function hci_req_sync(). Hence,
|
|
|
e91b83 |
the thread-A cannot issue th.
|
|
|
e91b83 |
|
|
|
e91b83 |
Signed-off-by: Lin Ma <linma@zju.edu.cn>
|
|
|
e91b83 |
Cc: Marcel Holtmann <marcel@holtmann.org>
|
|
|
e91b83 |
Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")
|
|
|
e91b83 |
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
|
e91b83 |
(cherry picked from commit e2cb6b891ad2b8caa9131e3be70f45243df82a80)
|
|
|
e91b83 |
Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
|
|
|
e91b83 |
Signed-off-by: Jan Stancek <jstancek@redhat.com>
|
|
|
e91b83 |
|
|
|
e91b83 |
Signed-off-by: Artem Savkov <asavkov@redhat.com>
|
|
|
e91b83 |
Acked-by: Yannick Cote <ycote@redhat.com>
|
|
|
e91b83 |
Acked-by: Joe Lawrence <joe.lawrence@redhat.com>
|
|
|
e91b83 |
---
|
|
|
e91b83 |
net/bluetooth/hci_request.c | 12 ++++++++----
|
|
|
e91b83 |
1 file changed, 8 insertions(+), 4 deletions(-)
|
|
|
e91b83 |
|
|
|
e91b83 |
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
|
|
|
e91b83 |
index cf1b42ec40af97..ca9088d439460e 100644
|
|
|
e91b83 |
--- a/net/bluetooth/hci_request.c
|
|
|
e91b83 |
+++ b/net/bluetooth/hci_request.c
|
|
|
e91b83 |
@@ -274,12 +274,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
|
|
|
e91b83 |
{
|
|
|
e91b83 |
int ret;
|
|
|
e91b83 |
|
|
|
e91b83 |
- if (!test_bit(HCI_UP, &hdev->flags))
|
|
|
e91b83 |
- return -ENETDOWN;
|
|
|
e91b83 |
-
|
|
|
e91b83 |
/* Serialize all requests */
|
|
|
e91b83 |
hci_req_sync_lock(hdev);
|
|
|
e91b83 |
- ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
|
|
|
e91b83 |
+ /* check the state after obtaing the lock to protect the HCI_UP
|
|
|
e91b83 |
+ * against any races from hci_dev_do_close when the controller
|
|
|
e91b83 |
+ * gets removed.
|
|
|
e91b83 |
+ */
|
|
|
e91b83 |
+ if (test_bit(HCI_UP, &hdev->flags))
|
|
|
e91b83 |
+ ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
|
|
|
e91b83 |
+ else
|
|
|
e91b83 |
+ ret = -ENETDOWN;
|
|
|
e91b83 |
hci_req_sync_unlock(hdev);
|
|
|
e91b83 |
|
|
|
e91b83 |
return ret;
|
|
|
e91b83 |
--
|
|
|
e91b83 |
2.26.3
|
|
|
e91b83 |
|