Received-SPF: pass (google.com: domain of linux-kernel+bounces-18004-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <20240104115453.1.Iaa08c695d3dcf819910ea723c3eb502935638172@changeid>
 <63d2b52d-8f0b-4456-896c-ecdaf835c65a@wanadoo.fr> <CABBYNZKo7sFQxE6cE=KTH6-DpL2NzpW7Yybdr49dhdih6+8dcg@mail.gmail.com>
In-Reply-To: <CABBYNZKo7sFQxE6cE=KTH6-DpL2NzpW7Yybdr49dhdih6+8dcg@mail.gmail.com>
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date: Fri, 5 Jan 2024 10:40:15 -0500
Message-ID: <CABBYNZ+BqXGcfpcLJZxC_9AO-2kiH4K8-yu3mgTq9uAxAMY09w@mail.gmail.com>
Subject: Re: [PATCH] Bluetooth: Avoid potential use-after-free in hci_error_reset
To: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: yinghsu@chromium.org, chromeos-bluetooth-upstreaming@chromium.org, 
	linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On Fri, Jan 5, 2024 at 10:36=E2=80=AFAM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Christophe,
>
> On Fri, Jan 5, 2024 at 2:15=E2=80=AFAM Christophe JAILLET
> <christophe.jaillet@wanadoo.fr> wrote:
> >
> > Le 04/01/2024 =C3=A0 12:56, Ying Hsu a =C3=A9crit :
> > > While handling the HCI_EV_HARDWARE_ERROR event, if the underlying
> > > BT controller is not responding, the GPIO reset mechanism would
> > > free the hci_dev and lead to a use-after-free in hci_error_reset.
> > >
> > > Here's the call trace observed on a ChromeOS device with Intel AX201:
> > >     queue_work_on+0x3e/0x6c
> > >     __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>]
> > >     ? init_wait_entry+0x31/0x31
> > >     __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>]
> > >     hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>]
> > >     process_one_work+0x1d8/0x33f
> > >     worker_thread+0x21b/0x373
> > >     kthread+0x13a/0x152
> > >     ? pr_cont_work+0x54/0x54
> > >     ? kthread_blkcg+0x31/0x31
> > >      ret_from_fork+0x1f/0x30
> > >
> > > This patch holds the reference count on the hci_dev while processing
> > > a HCI_EV_HARDWARE_ERROR event to avoid potential crash.
> > >
> > > Signed-off-by: Ying Hsu <yinghsu-F7+t8E8rja9g9hUCZPvPmw@public.gmane.=
org>
> > > ---
> > > Tested this commit on a chromebook with Intel BT controller.
> > >
> > >   net/bluetooth/hci_core.c | 2 ++
> > >   1 file changed, 2 insertions(+)
> > >
> > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > > index 65601aa52e0d..a42417926028 100644
> > > --- a/net/bluetooth/hci_core.c
> > > +++ b/net/bluetooth/hci_core.c
> > > @@ -1049,6 +1049,7 @@ static void hci_error_reset(struct work_struct =
*work)
> > >   {
> > >       struct hci_dev *hdev =3D container_of(work, struct hci_dev, err=
or_reset);
> > >
> > > +     hci_dev_hold(hdev);
> > >       BT_DBG("%s", hdev->name);
> > >
> > >       if (hdev->hw_error)
> > > @@ -1060,6 +1061,7 @@ static void hci_error_reset(struct work_struct =
*work)
> > >               return;
> >
> >                  ^^^^^
> > Should we also call hci_dev_put() if we hit this return?
>
> Yep, I will fix that since Ive already pushed to bluetooth-next.

Here is the proposed change:

-       if (hci_dev_do_close(hdev))
-               return;
+       if (!hci_dev_do_close(hdev))
+               hci_dev_do_open(hdev);

-       hci_dev_do_open(hdev);
+       hci_dev_put(hdev);

> >
> > CJ
> >
> > >
> > >       hci_dev_do_open(hdev);
> > > +     hci_dev_put(hdev);
> > >   }
> > >
> > >   void hci_uuids_clear(struct hci_dev *hdev)
> >
>
>
> --
> Luiz Augusto von Dentz


--=20
Luiz Augusto von Dentz