Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 15.0 \(3693.20.0.1.32\))
Subject: Re: How to reproduce the BUG general protection fault in
 hci_uart_tty_ioctl?
From:   Weiteng Chen <wchen130@ucr.edu>
In-Reply-To: <20230704030131.GY5866@linux-l9pv.suse>
Date:   Mon, 3 Jul 2023 21:07:38 -0700
Cc:     Yu Hao <yhao016@ucr.edu>, linux-bluetooth@vger.kernel.org,
        linux-kernel@vger.kernel.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <191B9131-6E47-49B6-8089-108E2B12B9DC@ucr.edu>
References: <20230628150140.GU21539@linux-l9pv.suse>
 <CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4Keh2ow@mail.gmail.com>
 <20230704030131.GY5866@linux-l9pv.suse>
To:     joeyli <jlee@suse.com>
Precedence: bulk

Hi Joey,

Sorry for my late response.

=
https://elixir.bootlin.com/linux/v6.3-rc7/source/drivers/bluetooth/hci_ldi=
sc.c#L764

switch (cmd) {
        case HCIUARTSETPROTO:
                if (!test_and_set_bit(HCI_UART_PROTO_SET, &hu->flags)) {
                        printk(=E2=80=9Ctest_and_set_bit=E2=80=A6=E2=80=9D=
) // insert a prink to make the race easy to trigger
                        err =3D hci_uart_set_proto(hu, arg);
                        if (err)
                                clear_bit(HCI_UART_PROTO_SET, =
&hu->flags);
                } else
                        err =3D -EBUSY;
                break;

        case HCIUARTGETPROTO:
                if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
                        err =3D hu->proto->id;  =E2=86=90- null pointer =
deference
                else
                        err =3D -EUNATCH;
                break;

This is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. =
HCI_UART_PROTO_SET is set before hu->proto is set and thus it may =
dereference a null pointer.

To easily trigger this bug, I inserted a prink in the source code so =
that the C producer can easily trigger the bug. Please let me know if =
you have any questions.

Best,
Weiteng Chen

> On Jul 3, 2023, at 8:01 PM, joeyli <jlee@suse.com> wrote:
>=20
> Hi,
>=20
> On Wed, Jun 28, 2023 at 06:57:47PM -0700, Yu Hao wrote:
>> Hi Weiteng,
>>=20
>> Could you give more info about the bug, e.g., kernel configuration,
>> qemu arguments.
>>=20
>=20
> Base on kernel code, looks that the HCIUARTSETPROTO and =
HCIUARTGETPROTO
> blocks in hci_uart_tty_ioctl() should use hci_uart->proto_lock.=20
>=20
> I have run the C reproducer a couple of days in qemu, but it did not
> reproduce issue until now.
>=20
> Does anyone know how to reproduce this issue easily?
>=20
> Thanks
> Joey Lee
>>=20
>> On Wed, Jun 28, 2023 at 8:02=E2=80=AFAM joeyli <jlee@suse.com> wrote:
>>>=20
>>> Hi Yu Hao,
>>>=20
>>> I am looking at your "BUG: general protection fault in =
hci_uart_tty_ioctl":
>>>=20
>>> =
https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPD=
eCO2g@mail.gmail.com/
>>>=20
>>> I am trying the C reproducer in your URL, but it is not success yet:
>>> https://gist.github.com/ZHYfeng/a3e3ff2bdfea5ed5de5475f0b54d55cb
>>>=20
>>> I am using v6.2 mainline kernel to run the C reproducer.
>>>=20
>>> Could you please provide suggestions for how to reproduce this =
issue?
>>> And what is your qemu environment for reproducing issue?
>>>=20
>>> Thanks a lot!
>>> Joey Lee