From: Ruihan Li <[email protected]>
The hci_conn_unlink function is being called by hci_conn_del, which
means it should not call hci_conn_del with the input parameter conn
again. If it does, conn may have already been released when
hci_conn_unlink returns, leading to potential UAF and double-free
issues.
This patch resolves the problem by modifying hci_conn_unlink to release
only conn's child links when necessary, but never release conn itself.
Reported-by: [email protected]
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <[email protected]>
Reported-by: [email protected]
Reported-by: Luiz Augusto von Dentz <[email protected]>
Reported-by: [email protected]
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
net/bluetooth/hci_conn.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 640b951bf40a..70e1655a9df6 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1083,8 +1083,18 @@ static void hci_conn_unlink(struct hci_conn *conn)
if (!conn->parent) {
struct hci_link *link, *t;
- list_for_each_entry_safe(link, t, &conn->link_list, list)
- hci_conn_unlink(link->conn);
+ list_for_each_entry_safe(link, t, &conn->link_list, list) {
+ struct hci_conn *child = link->conn;
+
+ hci_conn_unlink(child);
+
+ /* Due to race, SCO connection might be not established
+ * yet at this point. Delete it now, otherwise it is
+ * possible for it to be stuck and can't be deleted.
+ */
+ if (child->handle == HCI_CONN_HANDLE_UNSET)
+ hci_conn_del(child);
+ }
return;
}
@@ -1100,13 +1110,6 @@ static void hci_conn_unlink(struct hci_conn *conn)
kfree(conn->link);
conn->link = NULL;
-
- /* Due to race, SCO connection might be not established
- * yet at this point. Delete it now, otherwise it is
- * possible for it to be stuck and can't be deleted.
- */
- if (conn->handle == HCI_CONN_HANDLE_UNSET)
- hci_conn_del(conn);
}
int hci_conn_del(struct hci_conn *conn)
--
2.40.0
From: Ruihan Li <[email protected]>
Commit 06149746e720 ("Bluetooth: hci_conn: Add support for linking
multiple hcon") reintroduced a previously fixed bug [1] ("KASAN:
slab-use-after-free Read in hci_conn_hash_flush"). This bug was
originally fixed by commit 5dc7d23e167e ("Bluetooth: hci_conn: Fix
possible UAF").
The hci_conn_unlink function was added to avoid invalidating the link
traversal caused by successive hci_conn_del operations releasing extra
connections. However, currently hci_conn_unlink itself also releases
extra connections, resulted in the reintroduced bug.
This patch follows a more robust solution for cleaning up all
connections, by repeatedly removing the first connection until there are
none left. This approach does not rely on the inner workings of
hci_conn_del and ensures proper cleanup of all connections.
Meanwhile, we need to make sure that hci_conn_del never fails. Indeed it
doesn't, as it now always returns zero. To make this a bit clearer, this
patch also changes its return type to void.
Reported-by: [email protected]
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
include/net/bluetooth/hci_core.h | 2 +-
net/bluetooth/hci_conn.c | 33 +++++++++++++++++++++-----------
2 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index a6c8aee2f256..8baf34639939 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1327,7 +1327,7 @@ int hci_le_create_cis(struct hci_conn *conn);
struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
u8 role);
-int hci_conn_del(struct hci_conn *conn);
+void hci_conn_del(struct hci_conn *conn);
void hci_conn_hash_flush(struct hci_dev *hdev);
void hci_conn_check_pending(struct hci_dev *hdev);
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 44d0643fc681..ce588359b290 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1088,6 +1088,14 @@ static void hci_conn_unlink(struct hci_conn *conn)
hci_conn_unlink(child);
+ /* If hdev is down it means
+ * hci_dev_close_sync/hci_conn_hash_flush is in progress
+ * and links don't need to be cleanup as all connections
+ * would be cleanup.
+ */
+ if (!test_bit(HCI_UP, &hdev->flags))
+ continue;
+
/* Due to race, SCO connection might be not established
* yet at this point. Delete it now, otherwise it is
* possible for it to be stuck and can't be deleted.
@@ -1112,7 +1120,7 @@ static void hci_conn_unlink(struct hci_conn *conn)
conn->link = NULL;
}
-int hci_conn_del(struct hci_conn *conn)
+void hci_conn_del(struct hci_conn *conn)
{
struct hci_dev *hdev = conn->hdev;
@@ -1163,8 +1171,6 @@ int hci_conn_del(struct hci_conn *conn)
* rest of hci_conn_del.
*/
hci_conn_cleanup(conn);
-
- return 0;
}
struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
@@ -2465,22 +2471,27 @@ void hci_conn_enter_active_mode(struct hci_conn *conn, __u8 force_active)
/* Drop all connection on the device */
void hci_conn_hash_flush(struct hci_dev *hdev)
{
- struct hci_conn_hash *h = &hdev->conn_hash;
- struct hci_conn *c, *n;
+ struct list_head *head = &hdev->conn_hash.list;
+ struct hci_conn *conn;
BT_DBG("hdev %s", hdev->name);
- list_for_each_entry_safe(c, n, &h->list, list) {
- c->state = BT_CLOSED;
-
- hci_disconn_cfm(c, HCI_ERROR_LOCAL_HOST_TERM);
+ /* We should not traverse the list here, because hci_conn_del
+ * can remove extra links, which may cause the list traversal
+ * to hit items that have already been released.
+ */
+ while ((conn = list_first_entry_or_null(head,
+ struct hci_conn,
+ list)) != NULL) {
+ conn->state = BT_CLOSED;
+ hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM);
/* Unlink before deleting otherwise it is possible that
* hci_conn_del removes the link which may cause the list to
* contain items already freed.
*/
- hci_conn_unlink(c);
- hci_conn_del(c);
+ hci_conn_unlink(conn);
+ hci_conn_del(conn);
}
}
--
2.40.0
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=744510
---Test result---
Test Summary:
CheckPatch FAIL 3.26 seconds
GitLint FAIL 1.65 seconds
SubjectPrefix PASS 0.54 seconds
BuildKernel PASS 32.65 seconds
CheckAllWarning PASS 35.59 seconds
CheckSparse PASS 40.56 seconds
CheckSmatch PASS 112.78 seconds
BuildKernel32 PASS 31.49 seconds
TestRunnerSetup PASS 449.26 seconds
TestRunner_l2cap-tester PASS 16.56 seconds
TestRunner_iso-tester PASS 20.36 seconds
TestRunner_bnep-tester PASS 5.37 seconds
TestRunner_mgmt-tester PASS 111.98 seconds
TestRunner_rfcomm-tester PASS 8.60 seconds
TestRunner_sco-tester PASS 7.92 seconds
TestRunner_ioctl-tester PASS 9.26 seconds
TestRunner_mesh-tester PASS 6.79 seconds
TestRunner_smp-tester PASS 7.88 seconds
TestRunner_userchan-tester PASS 5.66 seconds
IncrementalBuild PASS 66.92 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v3,1/4] Bluetooth: Fix potential double free caused by hci_conn_unlink
WARNING: Reported-by: should be immediately followed by Link: with a URL to the report
#91:
Reported-by: [email protected]
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
WARNING: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#92:
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
WARNING: Unknown link reference 'Closes:', use 'Link:' instead
#92:
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
WARNING: Duplicate signature
#95:
Reported-by: [email protected]
WARNING: Reported-by: should be immediately followed by Link: with a URL to the report
#95:
Reported-by: [email protected]
Reported-by: Luiz Augusto von Dentz <[email protected]>
WARNING: Reported-by: should be immediately followed by Link: with a URL to the report
#96:
Reported-by: Luiz Augusto von Dentz <[email protected]>
Reported-by: [email protected]
WARNING: Reported-by: should be immediately followed by Link: with a URL to the report
#97:
Reported-by: [email protected]
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
total: 0 errors, 7 warnings, 0 checks, 33 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/src/13229309.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
[v3,2/4] Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
WARNING: Reported-by: should be immediately followed by Link: with a URL to the report
#95:
Reported-by: Luiz Augusto von Dentz <[email protected]>
Closes: https://lore.kernel.org/linux-bluetooth/CABBYNZ+1kce8_RJrLNOXd_8=Mdpb=2bx4Nto-hFORk=qiOkoCg@mail.gmail.com/
WARNING: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#96:
Closes: https://lore.kernel.org/linux-bluetooth/CABBYNZ+1kce8_RJrLNOXd_8=Mdpb=2bx4Nto-hFORk=qiOkoCg@mail.gmail.com/
WARNING: Unknown link reference 'Closes:', use 'Link:' instead
#96:
Closes: https://lore.kernel.org/linux-bluetooth/CABBYNZ+1kce8_RJrLNOXd_8=Mdpb=2bx4Nto-hFORk=qiOkoCg@mail.gmail.com/
total: 0 errors, 3 warnings, 0 checks, 15 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/src/13229310.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
[v3,3/4] Bluetooth: Fix UAF in hci_conn_hash_flush again
WARNING: Reported-by: should be immediately followed by Link: with a URL to the report
#105:
Reported-by: [email protected]
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
WARNING: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#106:
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
WARNING: Unknown link reference 'Closes:', use 'Link:' instead
#106:
Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
total: 0 errors, 3 warnings, 0 checks, 73 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/src/13229311.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v3,1/4] Bluetooth: Fix potential double free caused by hci_conn_unlink
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
15: B1 Line exceeds max length (88>80): "Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/"
[v3,2/4] Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
15: B1 Line exceeds max length (115>80): "Closes: https://lore.kernel.org/linux-bluetooth/CABBYNZ+1kce8_RJrLNOXd_8=Mdpb=2bx4Nto-hFORk=qiOkoCg@mail.gmail.com/"
[v3,3/4] Bluetooth: Fix UAF in hci_conn_hash_flush again
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
26: B1 Line exceeds max length (88>80): "Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/"
---
Regards,
Linux Bluetooth
Hi Luiz,
On Tue, 2 May 2023 14:25:24 -0700, Luiz Augusto von Dentz wrote:
> From: Ruihan Li <[email protected]>
>
> The hci_conn_unlink function is being called by hci_conn_del, which
> means it should not call hci_conn_del with the input parameter conn
> again. If it does, conn may have already been released when
> hci_conn_unlink returns, leading to potential UAF and double-free
> issues.
>
> This patch resolves the problem by modifying hci_conn_unlink to release
> only conn's child links when necessary, but never release conn itself.
>
> Reported-by: [email protected]
> Closes: https://lore.kernel.org/linux-bluetooth/[email protected]/
> Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
> Signed-off-by: Ruihan Li <[email protected]>
> Reported-by: [email protected]
> Reported-by: Luiz Augusto von Dentz <[email protected]>
> Reported-by: [email protected]
I don't think these tags are properly inserted in commit messages, are they?
> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
> ---
> net/bluetooth/hci_conn.c | 21 ++++++++++++---------
> 1 file changed, 12 insertions(+), 9 deletions(-)
>
> diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
> index 640b951bf40a..70e1655a9df6 100644
> --- a/net/bluetooth/hci_conn.c
> +++ b/net/bluetooth/hci_conn.c
> @@ -1083,8 +1083,18 @@ static void hci_conn_unlink(struct hci_conn *conn)
> if (!conn->parent) {
> struct hci_link *link, *t;
>
> - list_for_each_entry_safe(link, t, &conn->link_list, list)
> - hci_conn_unlink(link->conn);
> + list_for_each_entry_safe(link, t, &conn->link_list, list) {
> + struct hci_conn *child = link->conn;
> +
> + hci_conn_unlink(child);
> +
> + /* Due to race, SCO connection might be not established
> + * yet at this point. Delete it now, otherwise it is
> + * possible for it to be stuck and can't be deleted.
> + */
> + if (child->handle == HCI_CONN_HANDLE_UNSET)
> + hci_conn_del(child);
> + }
>
> return;
> }
> @@ -1100,13 +1110,6 @@ static void hci_conn_unlink(struct hci_conn *conn)
>
> kfree(conn->link);
> conn->link = NULL;
> -
> - /* Due to race, SCO connection might be not established
> - * yet at this point. Delete it now, otherwise it is
> - * possible for it to be stuck and can't be deleted.
> - */
> - if (conn->handle == HCI_CONN_HANDLE_UNSET)
> - hci_conn_del(conn);
> }
>
> int hci_conn_del(struct hci_conn *conn)
> --
> 2.40.0
Thanks,
Ruihan Li
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:
On Tue, 2 May 2023 14:25:24 -0700 you wrote:
> From: Ruihan Li <[email protected]>
>
> The hci_conn_unlink function is being called by hci_conn_del, which
> means it should not call hci_conn_del with the input parameter conn
> again. If it does, conn may have already been released when
> hci_conn_unlink returns, leading to potential UAF and double-free
> issues.
>
> [...]
Here is the summary with links:
- [v3,1/4] Bluetooth: Fix potential double free caused by hci_conn_unlink
https://git.kernel.org/bluetooth/bluetooth-next/c/3214238e9dc7
- [v3,2/4] Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
https://git.kernel.org/bluetooth/bluetooth-next/c/38e9b45310de
- [v3,3/4] Bluetooth: Fix UAF in hci_conn_hash_flush again
https://git.kernel.org/bluetooth/bluetooth-next/c/29f883dcbfd0
- [v3,4/4] Bluetooth: Unlink CISes when LE disconnects in hci_conn_del
https://git.kernel.org/bluetooth/bluetooth-next/c/e6e576ec4e72
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html