netdev - Re: [PATCH v2] Bluetooth: Fix l2cap_disconnect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 23 May 2023 12:04:39 +0200
From: Simon Horman <simon.horman@...igine.com>
To: Ying Hsu <yinghsu@...omium.org>
Cc: linux-bluetooth@...r.kernel.org,
	chromeos-bluetooth-upstreaming@...omium.org,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	Johan Hedberg <johan.hedberg@...il.com>,
	Luiz Augusto von Dentz <luiz.dentz@...il.com>,
	Marcel Holtmann <marcel@...tmann.org>,
	Paolo Abeni <pabeni@...hat.com>, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org
Subject: Re: [PATCH v2] Bluetooth: Fix l2cap_disconnect_req deadlock

On Mon, May 22, 2023 at 11:41:51PM +0000, Ying Hsu wrote:
> L2CAP assumes that the locks conn->chan_lock and chan->lock are
> acquired in the order conn->chan_lock, chan->lock to avoid
> potential deadlock.
> For example, l2sock_shutdown acquires these locks in the order:
>   mutex_lock(&conn->chan_lock)
>   l2cap_chan_lock(chan)
> 
> However, l2cap_disconnect_req acquires chan->lock in
> l2cap_get_chan_by_scid first and then acquires conn->chan_lock
> before calling l2cap_chan_del. This means that these locks are
> acquired in unexpected order, which leads to potential deadlock:
>   l2cap_chan_lock(c)
>   mutex_lock(&conn->chan_lock)
> 
> This patch uses __l2cap_get_chan_by_scid to replace
> l2cap_get_chan_by_scid and adjusts the locking order to avoid the
> potential deadlock.
> 
> Signed-off-by: Ying Hsu <yinghsu@...omium.org>
> ---
> This commit has been tested on a Chromebook device.
> 
> Changes in v2:
> - Adding the prefix "Bluetooth:" to subject line.
> 
>  net/bluetooth/l2cap_core.c | 26 ++++++++++++++++++++------
>  1 file changed, 20 insertions(+), 6 deletions(-)
> 
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 376b523c7b26..8f08192b8fb1 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -4651,8 +4651,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
>  
>  	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
>  
> -	chan = l2cap_get_chan_by_scid(conn, dcid);
> +	mutex_lock(&conn->chan_lock);
> +	chan = __l2cap_get_chan_by_scid(conn, dcid);
> +	if (chan) {
> +		chan = l2cap_chan_hold_unless_zero(chan);
> +		if (chan)
> +			l2cap_chan_lock(chan);
> +	}
> +
>  	if (!chan) {
> +		mutex_unlock(&conn->chan_lock);
>  		cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
>  		return 0;
>  	}

Hi Ying,

The conditional setting of chan and calling l2cap_chan_lock()
is both non-trivial and repeated. It seems that it ought to be
in a helper.

Something like this (I'm sure a better function name can be chosen):

	chan = __l2cap_get_and_lock_chan_by_scid(conn, dcid);
	if (!chan) {
		...
	}

	...