linux-kernel - Re: [PATCH v1 0/2] Fix for proto races in hci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 24 Aug 2018 20:34:16 +0200
From:   Marcel Holtmann <marcel@...tmann.org>
To:     Balakrishna Godavarthi <bgodavar@...eaurora.org>
Cc:     Johan Hedberg <johan.hedberg@...il.com>, mka@...omium.org,
        linux-kernel@...r.kernel.org, linux-bluetooth@...r.kernel.org,
        hemantg@...eaurora.org, linux-arm-msm@...r.kernel.org
Subject: Re: [PATCH v1 0/2] Fix for proto races in hci_serdev.

Hi Balakrishna,

> In recent testing we found that while removing hci_uart, we have seen
> execution of hci_uart_write_work() after calling vendor specific
> proto close. As we are freeing the vendor specific Tx and Rx buffers
> in vendor close, execution of functions i.e. Rx or Tx functions may cause
> a crash.
> 
> we already have a commit for hci_ldisc.c "e508e6026b19" and "048e1bd3a27f"
> to overcome the race condition.
> 
> Changes of v1:
> 
>  * clearing flag HCI_UART_PROTO_READY while mnodule deinit such that
>    we will not have any tractions further on Tx or Rx.
>  * added check of HCI_UART_PROTO_READY while dequeuing an packet.
> 
> 
> Balakrishna Godavarthi (2):
>  Bluetooth: hci_serdev: clear HCI_UART_PROTO_READY to avoid closing
>    proto races
>  Bluetooth: hci_serdev: Add protocol check in hci_uart_dequeue().
> 
> drivers/bluetooth/hci_serdev.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel