From patchwork Sun Aug 6 20:18:37 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pauli Virtanen X-Patchwork-Id: 712435 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89A6FC04A94 for ; Sun, 6 Aug 2023 20:20:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230132AbjHFUU3 (ORCPT ); Sun, 6 Aug 2023 16:20:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229852AbjHFUU1 (ORCPT ); Sun, 6 Aug 2023 16:20:27 -0400 Received: from lahtoruutu.iki.fi (lahtoruutu.iki.fi [IPv6:2a0b:5c81:1c1::37]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE1D41724 for ; Sun, 6 Aug 2023 13:20:24 -0700 (PDT) Received: from monolith.lan (unknown [193.138.7.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by lahtoruutu.iki.fi (Postfix) with ESMTPSA id 4RJrRT2lPgz49Q1j; Sun, 6 Aug 2023 23:20:20 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353221; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=qQ/2b4L7rBRc5IZPWLOSsKluo1grJKnEq9egpHwLt3Y=; b=HcGwAK37K6yT8ar5FAUOTE1bedns7ViHtPAK73Q3Denn2xV8kNmv5k0KsuUFvAcltSGGYY 5W0bB60HeP9q35W08hIiaXl9JhmCzj0jzkl/uXwlZEhLQNKcrIfHtYdMSZ8TRtQa+REvFB EpF2XpsBGWhkHCCFuJx7Z/e9nZQCmpb9IgAUvPdFx6mrXZZNQBlrXlE/8iFnaVZk36qpiY Fbsfr3QD+fEkTmy+Uv3IcFO8EhQVxar7Jicy9TSMKECqTigMEfgpErSYn8xmCEHRalHh5G 7OmcciraNp1V+mh1kJ0XmR0H+0pTO9FOkomvDPMWotn49U02X0SA8lFK2oT5rw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353221; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=qQ/2b4L7rBRc5IZPWLOSsKluo1grJKnEq9egpHwLt3Y=; b=baBgQKvFycUPzHetiI1Q7XADm31JganrbEA75xDd8F67VDujl8QUm4qN7G3jI+mwz7r3Vn GJZZlURqe+05BTRnHHREGAqe5M7fBtKuL1fbZ0u9S2JKJ6hxUcKI9Q7FsXK0wZbSTKKWcx j4Fgd+17F1hZzs7d2lUH15f7fyD+rgXTPZL3jbdH2EfrAnPdQ8RWDl/mjaOToewZ/gTwZ1 xlW/Oo5CGwj6G2FFMF2IAtgCNchDgGvmqW55KCzn7QotK9CMk9WT8sdn/SQD9J8O8+NGN+ 8BgmQkmyRvqBXAPpMVgWDO19/96BHjHYoCmTjcjJuuzUDoRIDrm1vtAt0MEZJw== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi ARC-Seal: i=1; s=lahtoruutu; d=iki.fi; t=1691353221; a=rsa-sha256; cv=none; b=vRWqIWUBHJewV9BSfHRnHH455g47KFpEEmmMywDKhho8g+Nne2UJZLJI2oZR+txZhz7Sa/ eSdK8X/hZVqhGTepYsBYgF1bvYbrukdamXJFuyXCea0eCr8qLFbfg9UACnqiddjWi9rumS CtrtyP5lQmfEup4BQ5KzqBbn+VTDSidXzmYSZuiPHGMavZaMUZOpjXEKTl2rBWSxsi+69W /ZY7wCwOz+WYZhG15KDlTygOSETRgbD4C+UTsjDU0sSuu6atxjdE13+uwMPaDJpGg2wzx0 l64kOupjy07/t6NS1IPsxCljPHyX6goUPT3MAplRA/wNm1EiXsePEUjpQ1hK2w== From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen Subject: [PATCH v2 1/4] Bluetooth: hci_sync: fix canceling LE scanning / CIS create conn state Date: Sun, 6 Aug 2023 23:18:37 +0300 Message-ID: X-Mailer: git-send-email 2.41.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org In hci_abort_conn_sync, some errors from hci_le_connect_cancel_sync indicate the connection can be terminated immediately. However, hci_abort_conn_sync passes these errors through, making hci_disconnect_all_sync stop processing in these cases. Fix by using a separate flag to indicate if canceled connection can be deleted directly. Fixes: 0f2efc1d02d5 ("Bluetooth: hci_conn: Consolidate code for aborting connections") Fixes: dd1f6778b17b ("Bluetooth: hci_sync: delete CIS in BT_OPEN/CONNECT/BOUND when aborting") Signed-off-by: Pauli Virtanen --- Notes: v2: no change net/bluetooth/hci_sync.c | 48 ++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 41a8e57d8267..51ff682f66e0 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -5253,13 +5253,14 @@ static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn, } static int hci_le_connect_cancel_sync(struct hci_dev *hdev, - struct hci_conn *conn, u8 reason) + struct hci_conn *conn, u8 reason, + bool *del) { - /* Return reason if scanning since the connection shall probably be - * cleanup directly. - */ - if (test_bit(HCI_CONN_SCANNING, &conn->flags)) - return reason; + /* If scanning, connection can be just deleted */ + if (test_bit(HCI_CONN_SCANNING, &conn->flags)) { + *del = true; + return 0; + } if (conn->role == HCI_ROLE_SLAVE || test_and_set_bit(HCI_CONN_CANCEL, &conn->flags)) @@ -5270,10 +5271,10 @@ static int hci_le_connect_cancel_sync(struct hci_dev *hdev, } static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn, - u8 reason) + u8 reason, bool *del) { if (conn->type == LE_LINK) - return hci_le_connect_cancel_sync(hdev, conn, reason); + return hci_le_connect_cancel_sync(hdev, conn, reason, del); if (conn->type == ISO_LINK) { /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E @@ -5287,9 +5288,9 @@ static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn, if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) return hci_disconnect_sync(hdev, conn, reason); - /* CIS with no Create CIS sent have nothing to cancel */ + /* CIS with no Create CIS sent can be just deleted */ if (bacmp(&conn->dst, BDADDR_ANY)) - return HCI_ERROR_LOCAL_HOST_TERM; + *del = true; /* There is no way to cancel a BIS without terminating the BIG * which is done later on connection cleanup. @@ -5370,6 +5371,7 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) { int err = 0; u16 handle = conn->handle; + bool del = false; switch (conn->state) { case BT_CONNECTED: @@ -5377,17 +5379,15 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) err = hci_disconnect_sync(hdev, conn, reason); break; case BT_CONNECT: - err = hci_connect_cancel_sync(hdev, conn, reason); + err = hci_connect_cancel_sync(hdev, conn, reason, &del); break; case BT_CONNECT2: err = hci_reject_conn_sync(hdev, conn, reason); break; case BT_OPEN: case BT_BOUND: - hci_dev_lock(hdev); - hci_conn_failed(conn, reason); - hci_dev_unlock(hdev); - return 0; + del = true; + break; default: conn->state = BT_CLOSED; return 0; @@ -5398,18 +5398,15 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) * or in case of LE it was still scanning so it can be cleanup * safely. */ - if (err) { - struct hci_conn *c; + if (err || del) { + hci_dev_lock(hdev); /* Check if the connection hasn't been cleanup while waiting * commands to complete. */ - c = hci_conn_hash_lookup_handle(hdev, handle); - if (!c || c != conn) - return 0; + if (hci_conn_hash_lookup_handle(hdev, handle) == conn) + hci_conn_failed(conn, del ? reason : err); - hci_dev_lock(hdev); - hci_conn_failed(conn, err); hci_dev_unlock(hdev); } @@ -6311,8 +6308,11 @@ int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn) conn->conn_timeout, NULL); done: - if (err == -ETIMEDOUT) - hci_le_connect_cancel_sync(hdev, conn, 0x00); + if (err == -ETIMEDOUT) { + bool __maybe_unused del; + + hci_le_connect_cancel_sync(hdev, conn, 0x00, &del); + } /* Re-enable advertising after the connection attempt is finished. */ hci_resume_advertising_sync(hdev); From patchwork Sun Aug 6 20:18:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pauli Virtanen X-Patchwork-Id: 710988 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67C05C41513 for ; Sun, 6 Aug 2023 20:20:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229999AbjHFUU1 (ORCPT ); Sun, 6 Aug 2023 16:20:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229503AbjHFUU0 (ORCPT ); Sun, 6 Aug 2023 16:20:26 -0400 Received: from lahtoruutu.iki.fi (lahtoruutu.iki.fi [185.185.170.37]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C5AF1721 for ; Sun, 6 Aug 2023 13:20:23 -0700 (PDT) Received: from monolith.lan (unknown [193.138.7.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by lahtoruutu.iki.fi (Postfix) with ESMTPSA id 4RJrRV1jBpz49Q4L; Sun, 6 Aug 2023 23:20:22 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3q+xHwPvfdebNrGao4COGz1LFLBg1RSl7sHHGQU5F2A=; b=k+AHcpHB5GX7gYcuECgyKzJX3rKAfSiH1BBqTs9h8fBArL2R90JD7BTQyj75sdyJTjjRCA P9lxQxNVCJXgnvD00QV3g9NpwxuW+j5pUgb0VmXgNgy3zVEWHsIwChmtHdu6a3n4WPboD0 h/VT6cn8BUl89fnFDz8GQ/K8BdUVLuEBMsg/hkHRxXxJqVTLFmxvWvDdB5O6MpLVav4lhy t+pXJcZGv8upHPr8XHhzzwHgUlLBUHO9DrHcZVGzEGfeqQpNRApRANOUlhKLLnN1thGNHj J2ig1pD0X283NHc4Ng9mo4KquJr9OCWBpY+uF0oHCOvLIbFrsOotCzm28JEAIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3q+xHwPvfdebNrGao4COGz1LFLBg1RSl7sHHGQU5F2A=; b=n8vAK+fTjqstv2Ft5L1oI/WqXvLhL/Fctws1Px/huG+0IX/sedYs/sB9qF9KEkY0kCGkZm JE4AOoGtHGe5cEbrk5kId1iDRqR61xJ0jP5nuaubWRRVimC73iKZYMlVCDFJStVFP57agi Lx62t9v/7r4XFDvVKflDs/+RR6J9UqhA0e8D3DoEHbhqoVvhx0xTYlNAWswPtT2bLKb1CE Nb7bGztIX8YCVXQhqd2/RwBuhK+WMjG8/FrVBl1Z3moGAUX2ItGYCDCeWYN+PLRt9exBKv 8UMo5UdpmYDBVlZOTqMB+0YXCofDT6WEQ3b71LntS5HUJjKWJaiezHnbQK3ehQ== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi ARC-Seal: i=1; s=lahtoruutu; d=iki.fi; t=1691353222; a=rsa-sha256; cv=none; b=r6JAgiZkt8RR9P0ohCe0BFbaRWVCs7w/7sCvlI95GDyC7Lv3QYsFJEMQq7yzb6LMUn2W4z h1rtG7zw7xjyXeFszdelHkYy5Az5dbS6aqis0xQvQGwqaxrDMf+LRpC/UVp0mGUx0m2Ttb GHluGKP92NsW4QAALJ2fWVp3eTKcNUAgpB+b7JwD0SEMk+ZMc8DdKzUESXm9WaVh0/6tmp OMv8qtOSq/aXQiLShRo9JbSbU6Eij/WVWhL2jOdczZI5Fh2+BauIMFicnLru87gklYR0Cm WYyWVJL+U3z4Bz7ryWJudVt0OwpwreuYXf+Kf2zxi8ol+6aMxVkkdcQSc5UC9w== From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen Subject: [PATCH v2 2/4] Bluetooth: hci_sync: fix use-after-free in hci_disconnect_all_sync Date: Sun, 6 Aug 2023 23:18:38 +0300 Message-ID: <7b81cf669e2172b2e69d3b4fe6c9c256f5249c69.1691352503.git.pav@iki.fi> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org Use-after-free occurs in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. This can occur while waiting for controller events (big time window) or at other times (less likely). Fix the iteration in hci_disconnect_all_sync to allow hci_conn to be deleted at any time. UAF crash log: ================================================================== BUG: KASAN: slab-use-after-free in hci_set_powered_sync (net/bluetooth/hci_sync.c:5424) [bluetooth] Read of size 8 at addr ffff888009d9c000 by task kworker/u9:0/124 CPU: 0 PID: 124 Comm: kworker/u9:0 Tainted: G W 6.5.0-rc1+ #10 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work [bluetooth] Call Trace: dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xdd/0x160 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] kasan_report+0xa6/0xe0 ? hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_set_powered_sync+0x2c9/0x4a0 [bluetooth] ? __pfx_hci_set_powered_sync+0x10/0x10 [bluetooth] ? __pfx_lock_release+0x10/0x10 ? __pfx_set_powered_sync+0x10/0x10 [bluetooth] hci_cmd_sync_work+0x137/0x220 [bluetooth] process_one_work+0x526/0x9d0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x1a/0x90 worker_thread+0x92/0x630 ? __pfx_worker_thread+0x10/0x10 kthread+0x196/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 Allocated by task 1782: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x8f/0xa0 hci_conn_add+0xa5/0xa80 [bluetooth] hci_bind_cis+0x881/0x9b0 [bluetooth] iso_connect_cis+0x121/0x520 [bluetooth] iso_sock_connect+0x3f6/0x790 [bluetooth] __sys_connect+0x109/0x130 __x64_sys_connect+0x40/0x50 do_syscall_64+0x60/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 695: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 __kasan_slab_free+0x10a/0x180 __kmem_cache_free+0x14d/0x2e0 device_release+0x5d/0xf0 kobject_put+0xdf/0x270 hci_disconn_complete_evt+0x274/0x3a0 [bluetooth] hci_event_packet+0x579/0x7e0 [bluetooth] hci_rx_work+0x287/0xaa0 [bluetooth] process_one_work+0x526/0x9d0 worker_thread+0x92/0x630 kthread+0x196/0x1e0 ret_from_fork+0x2c/0x50 ================================================================== Fixes: 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier") Signed-off-by: Pauli Virtanen --- Notes: v2: use only valid values for abort_reason, in case we fail before handling all conns This is still a bit clumsy, a separate flag indicating if connection was aborted yet could be better. net/bluetooth/hci_sync.c | 47 ++++++++++++++++++++++++++++++++++------ 1 file changed, 40 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 51ff682f66e0..228259f44815 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -5415,16 +5415,49 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason) { - struct hci_conn *conn, *tmp; - int err; + struct hci_conn *c, *conn; + int err = 0; - list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) { - err = hci_abort_conn_sync(hdev, conn, reason); - if (err) - return err; + rcu_read_lock(); + + /* Any conn may be gone while waiting for events, iterate safely. + * If conn is in conn_hash and we didn't abort it, it probably + * has not yet been aborted. + */ + list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { + if (c->abort_reason != reason) + continue; + + c->abort_reason = (reason != HCI_ERROR_REMOTE_USER_TERM) ? + HCI_ERROR_REMOTE_USER_TERM : HCI_ERROR_UNSPECIFIED; } - return 0; + do { + conn = NULL; + list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { + if (c->abort_reason == reason) + continue; + + conn = c; + break; + } + if (!conn) + break; + + conn->abort_reason = reason; + hci_conn_get(conn); + + rcu_read_unlock(); + + err = hci_abort_conn_sync(hdev, conn, reason); + hci_conn_put(conn); + + rcu_read_lock(); + } while (!err); + + rcu_read_unlock(); + + return err; } /* This function perform power off HCI command sequence as follows: From patchwork Sun Aug 6 20:18:39 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pauli Virtanen X-Patchwork-Id: 712436 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43D4FC0015E for ; Sun, 6 Aug 2023 20:20:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230098AbjHFUU3 (ORCPT ); Sun, 6 Aug 2023 16:20:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229705AbjHFUU0 (ORCPT ); Sun, 6 Aug 2023 16:20:26 -0400 Received: from lahtoruutu.iki.fi (lahtoruutu.iki.fi [IPv6:2a0b:5c81:1c1::37]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01D261725 for ; Sun, 6 Aug 2023 13:20:24 -0700 (PDT) Received: from monolith.lan (unknown [193.138.7.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by lahtoruutu.iki.fi (Postfix) with ESMTPSA id 4RJrRV2jCJz49Q64; Sun, 6 Aug 2023 23:20:22 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=10nB+Wh+NxCOugfbv+kTYq9QX8gX/cCaF72EnwHIaWs=; b=fVFMv8/Imgj9FTxS80i1ntn1iIWjJhbOnbl2iJezkdv4kUz8g/Aqr/rk94f1Cf4rBpARf0 +ZiwEB4AT5NKy1h+/hhwG3UXv7m++fSUkmVhWIzeQjM2Z0UPpv/589Niquncduy2RGTlgL aUKMHqqDLy8TqL2F1P9LVa4pzVIwkePGZAcfUyTamrb1rubV5Pvrykgv3jKLX8S719yBUR TMRp0lIsnBrMZH6oIFcU9wPlp34BapOvKBByrAlcdjHvT2QqnLa2gHU5/QsEwGqAc/NHyu HmoCyfQ9vvn/2hnhq3Nkz59MW8Y2r4IwMh7CskHRd0Opu/rI01GWli2aZ2U5+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=10nB+Wh+NxCOugfbv+kTYq9QX8gX/cCaF72EnwHIaWs=; b=eiuxaP1pP94HHk4YeJWYIwLGvVbq/MGkSOZqWwCTdorYFS/AU9knTVri2D4ENChOPK4eVl oUZlwJXLqy3s5CssME9wgXEiOiv6NMx6rDaVqgY6iwyH7+GvFr7JOneqhe0Jdzy37B8wgG B+Y0+Er1c16W6TCsvt1J9c9dtf7KNoJDFclJpsV92zj7VnOPsvOFVVw0HMhNogxQyDhjto 8nH0tpsKdVCuDNZIWNlRA+Nk8RnqIrIxqy5Fkpeg+QIHy1APr49tACKNS08xfT5wsTPQVQ MLtbGQlO/7TuYXuXdybmc2z/21QXnVlQ2B01y1vcZcs0IksQBZcQ0kGpcxukoQ== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi ARC-Seal: i=1; s=lahtoruutu; d=iki.fi; t=1691353222; a=rsa-sha256; cv=none; b=fGIf3+/UhkaLsk7fHk5CKpy8aiBnR1cw3AdIiXj0qV96ihR5Ww5BPcyjHpxEaffVVHmKlV 0E3cK1cOxiohDm5JJ4ojXNbMsp+O6TxBdFupc42gzkjoHM/SaemZfSQqB1vTX6LyuZTjhc 6AXzR3vrgnsnNq8c7ZhkK/OMsvs/Yu7L8yvY8ttsHscVnxZRw8YYqbYgpE1xsOg7oXIaEq NO82EFPseTSmFi167z8TDHWeJ8mCrU6D6/du+0ptcLGWFTiJ6ixJDRhZrA4Iuz+l7bAhBh MWuRwxPO9X1M4ORTkmUb2aiMKseD/7YMUUmg6stk/YJUeoWCRUNM6J6p3reMHQ== From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen Subject: [PATCH v2 3/4] Bluetooth: hci_sync: disconnect linked connections before parents Date: Sun, 6 Aug 2023 23:18:39 +0300 Message-ID: <89fd73eb453f951438c594222828aafe8e4640a3.1691352503.git.pav@iki.fi> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org SCO/ISO connections are disconnected implicitly if the ACL connection is gone. If we disconnect ACL first, controller may error disconnecting ISO/SCO, which in hci_disconnect_all_sync fails powering off. With ISO connections present, powering off usually fails because of this. Fix by aborting linked connections first in hci_disconnect_all_sync. Signed-off-by: Pauli Virtanen --- Notes: v2: new patch net/bluetooth/hci_sync.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 228259f44815..a476594ecd2a 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -5435,10 +5435,26 @@ static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason) do { conn = NULL; list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) { + struct hci_link *link; + if (c->abort_reason == reason) continue; conn = c; + + /* Abort linked connections first. Disconnecting ACL + * implicitly disconnects SCO/ISO, and controller may + * error commands disconnecting them after ACL. + * (See Core v5.4 Vol 4 Part E Sec 7.1.6) + */ + if (conn->parent) + break; + list_for_each_entry_rcu(link, &conn->link_list, list) { + if (link->conn->abort_reason != reason) { + conn = link->conn; + break; + } + } break; } if (!conn) From patchwork Sun Aug 6 20:18:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pauli Virtanen X-Patchwork-Id: 710987 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 78908C04A6A for ; Sun, 6 Aug 2023 20:20:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230019AbjHFUU2 (ORCPT ); Sun, 6 Aug 2023 16:20:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229649AbjHFUU0 (ORCPT ); Sun, 6 Aug 2023 16:20:26 -0400 Received: from lahtoruutu.iki.fi (lahtoruutu.iki.fi [185.185.170.37]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C92F1722 for ; Sun, 6 Aug 2023 13:20:24 -0700 (PDT) Received: from monolith.lan (unknown [193.138.7.198]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by lahtoruutu.iki.fi (Postfix) with ESMTPSA id 4RJrRV3j8Kz49Q8H; Sun, 6 Aug 2023 23:20:22 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NS2VaQ7geGZzm/jXHh7YZtOLYcCN+so+PWM+FlPyk30=; b=PBF5eYAzaU/+N4JtpMytfZaJW7CXbj67LmksYFVeF0GGr/fgoLDrx5FISWHzAcdzYDbZfz HDH06xIodUVUjDevLuBXDmYfBEFefgA+cEEeMzYHAq2gITq+Q4fc2+GWyQyRngPFozzrin LmaF6XX9/vZoZHfbeSknjmmstsTId+Mdc8HMPVlemTXEf+Eh857Tutdv5V1wIqMt7O2W2i 5Xf4EwJ4QuVKo/LgDBzxaz20PEZQc0aal7v6kMZ60W2tg1DuqMdgQ5DBPTQuHIdH6tnySd SU8dn6QDpUNwx0wtSbNmRuOiyHThPc9PIrg/LMMpkTWPNaY8HboFp8NZbw5oKQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=lahtoruutu; t=1691353222; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=NS2VaQ7geGZzm/jXHh7YZtOLYcCN+so+PWM+FlPyk30=; b=avUAPM7q5CYXXRMVAXm68FLLAv1XMljzDys1wO6uTfoa155ayorEcpdiemOceLuOwVxUF+ CpBCxEtyuOkuTnggn0VCX3WTWqr0LrtM3c5tDgkDIv1FNUZKX6hakE0iPngTU2sa8WnZLY PhJfBYsvVf4scNJmga5wsl7E374hWshNZvh0VlwUTKR9W66eTYLH+17yySnpJ2fOlZXfXi hDWLYMxs9dooJggWZOlTXQFkAwD4fSrqbZcueCuo0Nk3EoYOLWjPU8j4rFya/coPG0bl8C sQpqAhJ1Dcfk9JkpknojhNkkRgXE2uwdlVN2QK6EmkuswpXQq2VxMIgqhzYo2g== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi ARC-Seal: i=1; s=lahtoruutu; d=iki.fi; t=1691353222; a=rsa-sha256; cv=none; b=q8t3U/D003ytyDNNZL+IMo2HXcUbSnIw2AIFWEdkXQU5iN3Zph/zDG5zqluj8y+Zi9jtuQ FxCva7RG77N1eqdpoD9y2v1zi5fqhrDzg74Te77mYhp9GXrsmUAxkEaMJkQwxTrSxMxIIL RRH2cgtqDYJQ/rGWf0zIVzja2JfyipIwCATerSihScSraLXpdvLJ6WNW3YEqKuHI4CFBJ9 WsIk74PfCNp49vX6blcl66Dm4kLPnH1DoNg7bXghm/6VPeSVh+Qb1Ie5zAkURzN4U++DSp d0VQCvHnG+WfmStD23SZsJGSpWCToEiN+yJExbE/Neu7Jj5+LRv/49zlegGcfQ== From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen Subject: [PATCH v2 4/4] Bluetooth: hci_conn: verify connection is to be aborted before doing it Date: Sun, 6 Aug 2023 23:18:40 +0300 Message-ID: <8e9dcf715fa1215545c1a01ad44b62d77a4edebe.1691352503.git.pav@iki.fi> X-Mailer: git-send-email 2.41.0 In-Reply-To: References: MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org When processing connections in abort_conn_sync, also check the connection handle still refers to a connection that should be aborted. There is a theoretical race condition where a connection handle is reused, after hci_abort_conn but before abort_conn_sync is processed in hci_sync. This change should avoid terminating a wrong connection in this case. Signed-off-by: Pauli Virtanen --- Notes: v2: no change net/bluetooth/hci_conn.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index ae206eb551f7..b65a1e9b178b 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -2861,7 +2861,7 @@ static int abort_conn_sync(struct hci_dev *hdev, void *data) u16 handle = PTR_ERR(data); conn = hci_conn_hash_lookup_handle(hdev, handle); - if (!conn) + if (!conn || !conn->abort_reason) return 0; return hci_abort_conn_sync(hdev, conn, conn->abort_reason); @@ -2876,6 +2876,8 @@ int hci_abort_conn(struct hci_conn *conn, u8 reason) */ if (conn->abort_reason) return 0; + if (!reason) + return -EINVAL; bt_dev_dbg(hdev, "handle 0x%2.2x reason 0x%2.2x", conn->handle, reason);