| Message ID | 20240507114244.120751-1-oficerovas@altlinux.org |
|---|---|
| State | New |
| Headers | show |
| Series | Bluetooth: RFCOMM: possible deadlock in rfcomm_dlc_exists | expand |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=851144 ---Test result--- Test Summary: CheckPatch PASS 0.94 seconds GitLint PASS 0.27 seconds SubjectPrefix PASS 0.09 seconds BuildKernel PASS 30.21 seconds CheckAllWarning PASS 33.33 seconds CheckSparse PASS 38.87 seconds CheckSmatch FAIL 36.55 seconds BuildKernel32 PASS 29.16 seconds TestRunnerSetup PASS 526.28 seconds TestRunner_l2cap-tester PASS 18.55 seconds TestRunner_iso-tester FAIL 33.83 seconds TestRunner_bnep-tester PASS 4.72 seconds TestRunner_mgmt-tester PASS 107.38 seconds TestRunner_rfcomm-tester PASS 7.35 seconds TestRunner_sco-tester PASS 15.08 seconds TestRunner_ioctl-tester PASS 7.69 seconds TestRunner_mesh-tester PASS 5.76 seconds TestRunner_smp-tester PASS 6.77 seconds TestRunner_userchan-tester PASS 4.91 seconds IncrementalBuild PASS 28.57 seconds Details ############################## Test: CheckSmatch - FAIL Desc: Run smatch tool with source Output: Segmentation fault (core dumped) make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139 make[4]: *** Deleting file 'net/bluetooth/hci_core.o' make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:485: net] Error 2 make[2]: *** Waiting for unfinished jobs.... Segmentation fault (core dumped) make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139 make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o' make[4]: *** Waiting for unfinished jobs.... Segmentation fault (core dumped) make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bpa10x.o] Error 139 make[4]: *** Deleting file 'drivers/bluetooth/bpa10x.o' make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:485: drivers] Error 2 make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2 make: *** [Makefile:240: __sub-make] Error 2 ############################## Test: TestRunner_iso-tester - FAIL Desc: Run iso-tester with test-runner Output: Total: 122, Passed: 121 (99.2%), Failed: 1, Not Run: 0 Failed Test Cases ISO Connect2 Suspend - Success Failed 6.251 seconds --- Regards, Linux Bluetooth
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index 1d34d849703329..d8502914e3602c 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -490,8 +490,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err) rfcomm_dlc_lock(d); d->state = BT_CLOSED; - d->state_change(d, err); rfcomm_dlc_unlock(d); + d->state_change(d, err); skb_queue_purge(&d->tx_queue); rfcomm_dlc_unlink(d); diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 29aa07e9db9d71..cbff37b3273407 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon if (err == -ENOIOCTLCMD) { #ifdef CONFIG_BT_RFCOMM_TTY - lock_sock(sk); err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg); - release_sock(sk); #else err = -EOPNOTSUPP; #endif diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c index 69c75c041fe10a..5be21b987141fc 100644 --- a/net/bluetooth/rfcomm/tty.c +++ b/net/bluetooth/rfcomm/tty.c @@ -403,9 +403,12 @@ static int __rfcomm_create_dev(struct sock *sk, void __user *arg) return -EPERM; if (req.flags & (1 << RFCOMM_REUSE_DLC)) { + lock_sock(sk); /* Socket must be connected */ - if (sk->sk_state != BT_CONNECTED) + if (sk->sk_state != BT_CONNECTED) { + release_sock(sk); return -EBADFD; + } dlc = rfcomm_pi(sk)->dlc; rfcomm_dlc_hold(dlc); @@ -422,13 +425,13 @@ static int __rfcomm_create_dev(struct sock *sk, void __user *arg) } id = rfcomm_dev_add(&req, dlc); - if (id < 0) - return id; if (req.flags & (1 << RFCOMM_REUSE_DLC)) { /* DLC is now used by device. * Socket must be disconnected */ - sk->sk_state = BT_CLOSED; + if (!(id < 0)) + sk->sk_state = BT_CLOSED; + release_sock(sk); } return id;
This bug was found by syzkaller. This bug is also very similar to another RFCOMM possible deadlock in rfcomm_dlc_exists. Both of these bugs are present in syzbot. Patch fixes two of these possible dedlock errors. Also this particular patch was already written in march of 2023 by Hillf Danton, but seems like it just got lost or forgotten. Links to these bugs and original patch on syzbot: Link: https://syzkaller.appspot.com/bug?extid=b69a625d06e8ece26415 Link: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218 Link: https://syzkaller.appspot.com/text?tag=Patch&x=133a6835c80000 Signed-off-by: Alexander Ofitserov <oficerovas@altlinux.org> --- net/bluetooth/rfcomm/core.c | 2 +- net/bluetooth/rfcomm/sock.c | 2 -- net/bluetooth/rfcomm/tty.c | 11 +++++++---- 3 files changed, 8 insertions(+), 7 deletions(-)