linux-kernel - Re: [PATCH] Bluetooth: Avoid potential use-after-free in hci_error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63d2b52d-8f0b-4456-896c-ecdaf835c65a@wanadoo.fr>
Date: Fri, 5 Jan 2024 08:14:59 +0100
From: Christophe JAILLET <christophe.jaillet@...adoo.fr>
To: yinghsu@...omium.org
Cc: chromeos-bluetooth-upstreaming@...omium.org,
 linux-bluetooth@...r.kernel.org, linux-kernel@...r.kernel.org,
 luiz.dentz@...il.com
Subject: Re: [PATCH] Bluetooth: Avoid potential use-after-free in
 hci_error_reset

Le 04/01/2024 à 12:56, Ying Hsu a écrit :
> While handling the HCI_EV_HARDWARE_ERROR event, if the underlying
> BT controller is not responding, the GPIO reset mechanism would
> free the hci_dev and lead to a use-after-free in hci_error_reset.
> 
> Here's the call trace observed on a ChromeOS device with Intel AX201:
>     queue_work_on+0x3e/0x6c
>     __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>]
>     ? init_wait_entry+0x31/0x31
>     __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>]
>     hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>]
>     process_one_work+0x1d8/0x33f
>     worker_thread+0x21b/0x373
>     kthread+0x13a/0x152
>     ? pr_cont_work+0x54/0x54
>     ? kthread_blkcg+0x31/0x31
>      ret_from_fork+0x1f/0x30
> 
> This patch holds the reference count on the hci_dev while processing
> a HCI_EV_HARDWARE_ERROR event to avoid potential crash.
> 
> Signed-off-by: Ying Hsu <yinghsu-F7+t8E8rja9g9hUCZPvPmw@...lic.gmane.org>
> ---
> Tested this commit on a chromebook with Intel BT controller.
> 
>   net/bluetooth/hci_core.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index 65601aa52e0d..a42417926028 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -1049,6 +1049,7 @@ static void hci_error_reset(struct work_struct *work)
>   {
>   	struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
>   
> +	hci_dev_hold(hdev);
>   	BT_DBG("%s", hdev->name);
>   
>   	if (hdev->hw_error)
> @@ -1060,6 +1061,7 @@ static void hci_error_reset(struct work_struct *work)
>   		return;

                 ^^^^^
Should we also call hci_dev_put() if we hit this return?

CJ

>   
>   	hci_dev_do_open(hdev);
> +	hci_dev_put(hdev);
>   }
>   
>   void hci_uuids_clear(struct hci_dev *hdev)