| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CABBYNZLpNbYDrP9aZqx9dm=XMh2KdRDAy+2gXX0wexMBHiQQUA@mail.gmail.com>
Date: Tue, 30 May 2023 13:50:37 -0700
From: Luiz Augusto von Dentz <luiz.dentz@...il.com>
To: Ying Hsu <yinghsu@...omium.org>
Cc: Simon Horman <simon.horman@...igine.com>,
linux-bluetooth@...r.kernel.org,
chromeos-bluetooth-upstreaming@...omium.org,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>,
Johan Hedberg <johan.hedberg@...il.com>,
Marcel Holtmann <marcel@...tmann.org>,
Paolo Abeni <pabeni@...hat.com>, linux-kernel@...r.kernel.org,
netdev@...r.kernel.org
Subject: Re: [PATCH v2] Bluetooth: Fix l2cap_disconnect_req deadlock
Hi Ying,
On Mon, May 29, 2023 at 10:08 PM Ying Hsu <yinghsu@...omium.org> wrote:
>
> Gentle ping, Luiz.
>
>
> On Thu, May 25, 2023 at 12:16 PM Ying Hsu <yinghsu@...omium.org> wrote:
> >
> > Hi Luiz,
> >
> > The proposal solves the deadlock but might introduce other problems as
> > it breaks the order of l2cap_chan_del.
> > There are another way to resolve the deadlock:
> > ```
> > @@ -4663,7 +4663,9 @@ static inline int l2cap_disconnect_req(struct
> > l2cap_conn *conn,
> >
> > chan->ops->set_shutdown(chan);
> >
> > + l2cap_chan_unlock(chan);
> > mutex_lock(&conn->chan_lock);
> > + l2cap_chan_lock(chan);
> > l2cap_chan_del(chan, ECONNRESET);
> > mutex_unlock(&conn->chan_lock);
> > ```
Yeah, I kind of like this better, that said I don't think changing the
order of l2cap_chan_del matters that much but it does change the
callback teardown sequence so perhaps we should stick to a simpler
solution for now.
Please submit an updated version so we can move forward with it.
> > If you're okay with it, I'll do some verification and post a full patch.
> >
> > Best regards,
> > Ying
> >
> > On Thu, May 25, 2023 at 2:56 AM Luiz Augusto von Dentz
> > <luiz.dentz@...il.com> wrote:
> > >
> > > Hi Ying,
> > >
> > > On Wed, May 24, 2023 at 3:54 AM Ying Hsu <yinghsu@...omium.org> wrote:
> > > >
> > > > Hi Simon,
> > > >
> > > > I understand your concern about the repeated code.
> > > > However, simply hiding the locking logic in another function
> > > > introduces hidden assumptions.
> > > > For this patch, I would like to fix the deadlock in a simple and easy
> > > > to understand way.
> > > > We can always refactor the l2cap_chan utility functions later.
> > > >
> > > > Hi Luis,
> > > >
> > > > I'll add a fixes tag in the next version.
> > >
> > > And how about doing this:
> > >
> > > https://gist.github.com/Vudentz/e513859ecb31e79c947dfcb4b5c60453
> > >
> > > > Best regards,
> > > > Ying
> > > >
> > > >
> > > > On Wed, May 24, 2023 at 3:06 AM Luiz Augusto von Dentz
> > > > <luiz.dentz@...il.com> wrote:
> > > > >
> > > > > Hi Simon, Ying,
> > > > >
> > > > > On Tue, May 23, 2023 at 3:04 AM Simon Horman <simon.horman@...igine.com> wrote:
> > > > > >
> > > > > > On Mon, May 22, 2023 at 11:41:51PM +0000, Ying Hsu wrote:
> > > > > > > L2CAP assumes that the locks conn->chan_lock and chan->lock are
> > > > > > > acquired in the order conn->chan_lock, chan->lock to avoid
> > > > > > > potential deadlock.
> > > > > > > For example, l2sock_shutdown acquires these locks in the order:
> > > > > > > mutex_lock(&conn->chan_lock)
> > > > > > > l2cap_chan_lock(chan)
> > > > > > >
> > > > > > > However, l2cap_disconnect_req acquires chan->lock in
> > > > > > > l2cap_get_chan_by_scid first and then acquires conn->chan_lock
> > > > > > > before calling l2cap_chan_del. This means that these locks are
> > > > > > > acquired in unexpected order, which leads to potential deadlock:
> > > > > > > l2cap_chan_lock(c)
> > > > > > > mutex_lock(&conn->chan_lock)
> > > > > > >
> > > > > > > This patch uses __l2cap_get_chan_by_scid to replace
> > > > > > > l2cap_get_chan_by_scid and adjusts the locking order to avoid the
> > > > > > > potential deadlock.
> > > > >
> > > > > This needs the fixes tag so we can backport it properly.
> > > > >
> > > > > > > Signed-off-by: Ying Hsu <yinghsu@...omium.org>
> > > > > > > ---
> > > > > > > This commit has been tested on a Chromebook device.
> > > > > > >
> > > > > > > Changes in v2:
> > > > > > > - Adding the prefix "Bluetooth:" to subject line.
> > > > > > >
> > > > > > > net/bluetooth/l2cap_core.c | 26 ++++++++++++++++++++------
> > > > > > > 1 file changed, 20 insertions(+), 6 deletions(-)
> > > > > > >
> > > > > > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > > > > > > index 376b523c7b26..8f08192b8fb1 100644
> > > > > > > --- a/net/bluetooth/l2cap_core.c
> > > > > > > +++ b/net/bluetooth/l2cap_core.c
> > > > > > > @@ -4651,8 +4651,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
> > > > > > >
> > > > > > > BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
> > > > > > >
> > > > > > > - chan = l2cap_get_chan_by_scid(conn, dcid);
> > > > > > > + mutex_lock(&conn->chan_lock);
> > > > > > > + chan = __l2cap_get_chan_by_scid(conn, dcid);
> > > > > > > + if (chan) {
> > > > > > > + chan = l2cap_chan_hold_unless_zero(chan);
> > > > > > > + if (chan)
> > > > > > > + l2cap_chan_lock(chan);
> > > > > > > + }
> > > > > > > +
> > > > > > > if (!chan) {
> > > > > > > + mutex_unlock(&conn->chan_lock);
> > > > > > > cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
> > > > > > > return 0;
> > > > > > > }
> > > > > >
> > > > > > Hi Ying,
> > > > > >
> > > > > > The conditional setting of chan and calling l2cap_chan_lock()
> > > > > > is both non-trivial and repeated. It seems that it ought to be
> > > > > > in a helper.
> > > > > >
> > > > > > Something like this (I'm sure a better function name can be chosen):
> > > > > >
> > > > > > chan = __l2cap_get_and_lock_chan_by_scid(conn, dcid);
> > > > > > if (!chan) {
> > > > > > ...
> > > > > > }
> > > > > >
> > > > > > ...
> > > > >
> > > > > Or perhaps we could do something like l2cap_del_chan_by_scid:
> > > > >
> > > > > https://gist.github.com/Vudentz/e513859ecb31e79c947dfcb4b5c60453
> > > > >
> > > > > --
> > > > > Luiz Augusto von Dentz
> > >
> > >
> > >
> > > --
> > > Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
Powered by blists - more mailing lists