2021-11-06 00:23:14

by Jesse Melhuish

Subject: [PATCH] bluetooth: Don't initialize msft/aosp when using user channel

A race condition is triggered when usermode control is given to
userspace before the kernel's MSFT query responds, resulting in an
unexpected response to userspace's reset command.

Issue can be observed in btmon:
< HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
05 01 ..
@ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
< HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
> HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
Vendor (0x3f|0x001e) ncmd 1
Status: Command Disallowed (0x0c)
05 .
> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
Reset (0x03|0x0003) ncmd 2
Status: Success (0x00)

Reviewed-by: Abhishek Pandit-Subedi <[email protected]>
Reviewed-by: Sonny Sasaka <[email protected]>
Signed-off-by: Jesse Melhuish <[email protected]>
---

net/bluetooth/hci_core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index c07b2d2a44b0..2b5df597e7ed 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1595,8 +1595,10 @@ static int hci_dev_do_open(struct hci_dev *hdev)
hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
ret = hdev->set_diag(hdev, true);

- msft_do_open(hdev);
- aosp_do_open(hdev);
+ if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
+ msft_do_open(hdev);
+ aosp_do_open(hdev);
+ }

clear_bit(HCI_INIT, &hdev->flags);

--
2.31.0

2021-11-06 00:28:02

by Luiz Augusto von Dentz

Subject: Re: [PATCH] bluetooth: Don't initialize msft/aosp when using user channel

Hi Jesse,

On Fri, Nov 5, 2021 at 3:29 PM Jesse Melhuish <[email protected]> wrote:
>
> A race condition is triggered when usermode control is given to
> userspace before the kernel's MSFT query responds, resulting in an
> unexpected response to userspace's reset command.
>
> Issue can be observed in btmon:
> < HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
> 05 01 ..
> @ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
> < HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
> > HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
> Vendor (0x3f|0x001e) ncmd 1
> Status: Command Disallowed (0x0c)
> 05 .
> > HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
> Reset (0x03|0x0003) ncmd 2
> Status: Success (0x00)
>
> Reviewed-by: Abhishek Pandit-Subedi <[email protected]>
> Reviewed-by: Sonny Sasaka <[email protected]>
> Signed-off-by: Jesse Melhuish <[email protected]>
> ---
>
> net/bluetooth/hci_core.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index c07b2d2a44b0..2b5df597e7ed 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -1595,8 +1595,10 @@ static int hci_dev_do_open(struct hci_dev *hdev)
> hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
> ret = hdev->set_diag(hdev, true);
>
> - msft_do_open(hdev);
> - aosp_do_open(hdev);
> + if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
> + msft_do_open(hdev);
> + aosp_do_open(hdev);
> + }

This probably needs rebasing since we had moved this code to
hci_sync.c:hci_dev_open_sync.

>
> clear_bit(HCI_INIT, &hdev->flags);
>
> --
> 2.31.0
>


--
Luiz Augusto von Dentz