linux-kernel - Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in lock_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240629113329.2452-1-hdanton@sina.com>
Date: Sat, 29 Jun 2024 19:33:29 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+55cd5225f71c5cff7f6f@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in lock_sock_nested (3)

On Sat, 29 Jun 2024 01:27:21 -0700
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    6c0483dbfe72 Merge tag 'nfsd-6.10-3' of git://git.kernel.o..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15373b8e980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  6c0483dbfe72

--- x/net/bluetooth/sco.c
+++ y/net/bluetooth/sco.c
@@ -1287,16 +1287,19 @@ static void sco_conn_ready(struct sco_co
 			return;
 		}
 
+		sock_hold(parent);
+		sco_conn_unlock(conn);
 		lock_sock(parent);
 
 		sk = sco_sock_alloc(sock_net(parent), NULL,
 				    BTPROTO_SCO, GFP_ATOMIC, 0);
 		if (!sk) {
 			release_sock(parent);
-			sco_conn_unlock(conn);
+			sock_put(parent);
 			return;
 		}
 
+		sco_conn_lock(conn);
 		sco_sock_init(sk, parent);
 
 		bacpy(&sco_pi(sk)->src, &conn->hcon->src);
@@ -1313,9 +1316,9 @@ static void sco_conn_ready(struct sco_co
 		/* Wake up parent */
 		parent->sk_data_ready(parent);
 
-		release_sock(parent);
-
 		sco_conn_unlock(conn);
+		release_sock(parent);
+		sock_put(parent);
 	}
 }
 
--