diff mbox series

[for,4.4] bluetooth: eliminate the potential race condition when removing the HCI controller

Message ID 20210528085224.1021277-1-nobuhiro1.iwamatsu@toshiba.co.jp
State New
Headers show
Series [for,4.4] bluetooth: eliminate the potential race condition when removing the HCI controller | expand

Commit Message

Nobuhiro Iwamatsu May 28, 2021, 8:52 a.m. UTC
From: Lin Ma <linma@zju.edu.cn>

commit e2cb6b891ad2b8caa9131e3be70f45243df82a80 upstream.

There is a possible race condition vulnerability between issuing a HCI
command and removing the cont.  Specifically, functions hci_req_sync()
and hci_dev_do_close() can race each other like below:

thread-A in hci_req_sync()      |   thread-B in hci_dev_do_close()
                                |   hci_req_sync_lock(hdev);
test_bit(HCI_UP, &hdev->flags); |
...                             |   test_and_clear_bit(HCI_UP, &hdev->flags)
hci_req_sync_lock(hdev);        |
                                |
In this commit we alter the sequence in function hci_req_sync(). Hence,
the thread-A cannot issue th.

Signed-off-by: Lin Ma <linma@zju.edu.cn>
Cc: Marcel Holtmann <marcel@holtmann.org>
Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[iwamatsu: adjust filename, arguments of __hci_req_sync(). CVE-2021-32399]
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
---
 net/bluetooth/hci_core.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

Comments

Greg KH May 31, 2021, 11:54 a.m. UTC | #1
On Fri, May 28, 2021 at 05:52:24PM +0900, Nobuhiro Iwamatsu wrote:
> From: Lin Ma <linma@zju.edu.cn>

> 

> commit e2cb6b891ad2b8caa9131e3be70f45243df82a80 upstream.

> 

> There is a possible race condition vulnerability between issuing a HCI

> command and removing the cont.  Specifically, functions hci_req_sync()

> and hci_dev_do_close() can race each other like below:

> 

> thread-A in hci_req_sync()      |   thread-B in hci_dev_do_close()

>                                 |   hci_req_sync_lock(hdev);

> test_bit(HCI_UP, &hdev->flags); |

> ...                             |   test_and_clear_bit(HCI_UP, &hdev->flags)

> hci_req_sync_lock(hdev);        |

>                                 |

> In this commit we alter the sequence in function hci_req_sync(). Hence,

> the thread-A cannot issue th.

> 

> Signed-off-by: Lin Ma <linma@zju.edu.cn>

> Cc: Marcel Holtmann <marcel@holtmann.org>

> Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy")

> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

> [iwamatsu: adjust filename, arguments of __hci_req_sync(). CVE-2021-32399]

> Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>

> ---

>  net/bluetooth/hci_core.c | 13 +++++++++----

>  1 file changed, 9 insertions(+), 4 deletions(-)


Now queued up, thanks.

greg k-h
diff mbox series

Patch

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index cc905a4e573253..81a81b9a3c7d00 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -371,12 +371,17 @@  static int hci_req_sync(struct hci_dev *hdev,
 {
 	int ret;
 
-	if (!test_bit(HCI_UP, &hdev->flags))
-		return -ENETDOWN;
-
 	/* Serialize all requests */
 	hci_req_lock(hdev);
-	ret = __hci_req_sync(hdev, req, opt, timeout);
+	/* check the state after obtaing the lock to protect the HCI_UP
+	 * against any races from hci_dev_do_close when the controller
+	 * gets removed.
+	 */
+	if (test_bit(HCI_UP, &hdev->flags))
+		ret = __hci_req_sync(hdev, req, opt, timeout);
+	else
+		ret = -ENETDOWN;
+
 	hci_req_unlock(hdev);
 
 	return ret;