* [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
@ 2023-03-08 16:45 Zheng Wang
2023-03-08 17:13 ` bluez.test.bot
2023-03-10 0:20 ` [PATCH] " patchwork-bot+bluetooth
0 siblings, 2 replies; 5+ messages in thread
From: Zheng Wang @ 2023-03-08 16:45 UTC (permalink / raw
To: marcel
Cc: johan.hedberg, luiz.dentz, linux-bluetooth, linux-kernel,
hackerzheng666, 1395428693sheep, alex000young, Zheng Wang
In btsdio_probe, the data->work is bound with btsdio_work. It will be
started in btsdio_send_frame.
If the btsdio_remove runs with a unfinished work, there may be a race
condition that hdev is freed but used in btsdio_work. Fix it by
canceling the work before do cleanup in btsdio_remove.
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
---
drivers/bluetooth/btsdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index 795be33f2892..f19d31ee37ea 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -357,6 +357,7 @@ static void btsdio_remove(struct sdio_func *func)
if (!data)
return;
+ cancel_work_sync(&data->work);
hdev = data->hdev;
sdio_set_drvdata(func, NULL);
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* RE: Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
2023-03-08 16:45 [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition Zheng Wang
@ 2023-03-08 17:13 ` bluez.test.bot
2023-03-10 0:20 ` [PATCH] " patchwork-bot+bluetooth
1 sibling, 0 replies; 5+ messages in thread
From: bluez.test.bot @ 2023-03-08 17:13 UTC (permalink / raw
To: linux-bluetooth, zyytlz.wz
[-- Attachment #1: Type: text/plain, Size: 2272 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=727958
---Test result---
Test Summary:
CheckPatch PASS 0.76 seconds
GitLint FAIL 0.83 seconds
SubjectPrefix PASS 0.13 seconds
BuildKernel PASS 39.44 seconds
CheckAllWarning PASS 42.69 seconds
CheckSparse PASS 47.97 seconds
CheckSmatch PASS 129.08 seconds
BuildKernel32 PASS 37.70 seconds
TestRunnerSetup PASS 534.76 seconds
TestRunner_l2cap-tester PASS 18.95 seconds
TestRunner_iso-tester PASS 20.78 seconds
TestRunner_bnep-tester PASS 6.83 seconds
TestRunner_mgmt-tester PASS 129.65 seconds
TestRunner_rfcomm-tester PASS 11.47 seconds
TestRunner_sco-tester PASS 10.05 seconds
TestRunner_ioctl-tester PASS 12.28 seconds
TestRunner_mesh-tester PASS 9.09 seconds
TestRunner_smp-tester PASS 9.82 seconds
TestRunner_userchan-tester PASS 7.66 seconds
IncrementalBuild PASS 35.26 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
3: B2 Line has trailing whitespace: "In btsdio_probe, the data->work is bound with btsdio_work. It will be "
6: B2 Line has trailing whitespace: "If the btsdio_remove runs with a unfinished work, there may be a race "
7: B2 Line has trailing whitespace: "condition that hdev is freed but used in btsdio_work. Fix it by "
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
2023-03-08 16:45 [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition Zheng Wang
2023-03-08 17:13 ` bluez.test.bot
@ 2023-03-10 0:20 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 5+ messages in thread
From: patchwork-bot+bluetooth @ 2023-03-10 0:20 UTC (permalink / raw
To: Zheng Wang
Cc: marcel, johan.hedberg, luiz.dentz, linux-bluetooth, linux-kernel,
hackerzheng666, 1395428693sheep, alex000young
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Thu, 9 Mar 2023 00:45:01 +0800 you wrote:
> In btsdio_probe, the data->work is bound with btsdio_work. It will be
> started in btsdio_send_frame.
>
> If the btsdio_remove runs with a unfinished work, there may be a race
> condition that hdev is freed but used in btsdio_work. Fix it by
> canceling the work before do cleanup in btsdio_remove.
>
> [...]
Here is the summary with links:
- Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
https://git.kernel.org/bluetooth/bluetooth-next/c/61115bb7574e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
@ 2023-09-02 10:21 Denis Efremov (Oracle)
2023-09-02 13:28 ` Greg KH
0 siblings, 1 reply; 5+ messages in thread
From: Denis Efremov (Oracle) @ 2023-09-02 10:21 UTC (permalink / raw
To: stable; +Cc: Zheng Wang, Luiz Augusto von Dentz, Denis Efremov
From: Zheng Wang <zyytlz.wz@163.com>
[ Upstream commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 ]
In btsdio_probe, the data->work is bound with btsdio_work. It will be
started in btsdio_send_frame.
If the btsdio_remove runs with a unfinished work, there may be a race
condition that hdev is freed but used in btsdio_work. Fix it by
canceling the work before do cleanup in btsdio_remove.
Fixes: CVE-2023-1989
Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Denis: Added CVE-2023-1989 and fixes tags. ]
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
---
CVE-2023-1989 is 1e9ac114c4428fdb7ff4635b45d4f46017e8916f.
However, the fix was reverted and replaced with 73f7b171b7.
In stable branches we've got only the original fix and its
revert. I'm sending the replacement fix. One can find a
reference to the new fix 73f7b171b7 in the revert commit
db2bf510bd5d.
drivers/bluetooth/btsdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index 795be33f2892..f19d31ee37ea 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -357,6 +357,7 @@ static void btsdio_remove(struct sdio_func *func)
if (!data)
return;
+ cancel_work_sync(&data->work);
hdev = data->hdev;
sdio_set_drvdata(func, NULL);
--
2.42.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
2023-09-02 10:21 Denis Efremov (Oracle)
@ 2023-09-02 13:28 ` Greg KH
0 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2023-09-02 13:28 UTC (permalink / raw
To: Denis Efremov (Oracle); +Cc: stable, Zheng Wang, Luiz Augusto von Dentz
On Sat, Sep 02, 2023 at 02:21:56PM +0400, Denis Efremov (Oracle) wrote:
> From: Zheng Wang <zyytlz.wz@163.com>
>
> [ Upstream commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 ]
>
> In btsdio_probe, the data->work is bound with btsdio_work. It will be
> started in btsdio_send_frame.
>
> If the btsdio_remove runs with a unfinished work, there may be a race
> condition that hdev is freed but used in btsdio_work. Fix it by
> canceling the work before do cleanup in btsdio_remove.
>
> Fixes: CVE-2023-1989
> Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
> Cc: stable@vger.kernel.org
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> [ Denis: Added CVE-2023-1989 and fixes tags. ]
> Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
> ---
>
> CVE-2023-1989 is 1e9ac114c4428fdb7ff4635b45d4f46017e8916f.
> However, the fix was reverted and replaced with 73f7b171b7.
> In stable branches we've got only the original fix and its
> revert. I'm sending the replacement fix. One can find a
> reference to the new fix 73f7b171b7 in the revert commit
> db2bf510bd5d.
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-09-02 13:28 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-03-08 16:45 [PATCH] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition Zheng Wang
2023-03-08 17:13 ` bluez.test.bot
2023-03-10 0:20 ` [PATCH] " patchwork-bot+bluetooth
-- strict thread matches above, loose matches on Subject: below --
2023-09-02 10:21 Denis Efremov (Oracle)
2023-09-02 13:28 ` Greg KH
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.