Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 31 May 2023 18:28:08 +0200
From:   Simon Horman <simon.horman@corigine.com>
To:     Ying Hsu <yinghsu@chromium.org>
Cc:     linux-bluetooth@vger.kernel.org,
        chromeos-bluetooth-upstreaming@chromium.org,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        Marcel Holtmann <marcel@holtmann.org>,
        Paolo Abeni <pabeni@redhat.com>, linux-kernel@vger.kernel.org,
        netdev@vger.kernel.org
Subject: Re: [PATCH v5] Bluetooth: Fix l2cap_disconnect_req deadlock
Message-ID: <ZHd1mPanIsBORpLE@corigine.com>
References: <20230531034522.375889-1-yinghsu@chromium.org>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230531034522.375889-1-yinghsu@chromium.org>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ivoAPdv0fp3Q4ULOHX4sbGsEVWh6nOhRnHlusM+hT6vTcuu7AxJLn6MSHmXw?=
 =?us-ascii?Q?NdvYhpAoOvCGdXWek5A2drOI3isetve+rqaINUmSWbpXm1Y19SLssqIl/VwI?=
 =?us-ascii?Q?6N+XGxz/8yR8fLZyztkCv1quJIUdmXa7bxTvXGYkj04N+HvNnZe/j+8ct1vD?=
 =?us-ascii?Q?D7i+S6n56Qt1/g/uMQjuTX3BmLZa0w7aWyv6jYVQ9CE53KSrhKAwTHhfeIng?=
 =?us-ascii?Q?4vCb6fbAUkG7kEzJ80UNuPHulhpkw/nHqRSM+QP0gxBnroEOCeGP7OJSFD2r?=
 =?us-ascii?Q?oHX/TKIaSwpa/fpn2R6QK3XJyD7feQc4YxVb/iMA4TVYnhFEE68nOtn1a0iV?=
 =?us-ascii?Q?NRcfqKuaiQi81+q4nlTVU7aoiZBIHYvFP0AWf2isQKl3DN+MI2eIjpROHP9f?=
 =?us-ascii?Q?+lefYWpuGCLG2xjt8Ii2ZM9cMlaJBpm7OJpmf9qwZaQ+kYwfJasGon/8h3NT?=
 =?us-ascii?Q?Jn/gnvZ91qg6Ks918fVttqegkCxqo7lhmH4fuArzI0qXAJ5rmWE8iSXlEK+A?=
 =?us-ascii?Q?HnQ3Qy+OmVnrwAOF7Ju7FIgBu3BcQGLq9OiMVTVKgtyiMgvqK4TH1dJmKabB?=
 =?us-ascii?Q?st0vhZnT8MROocQp7aKOxGgzRFEG+J3eiH3MkPs3ZxOW7IzwJZZ7fLb1LpcW?=
 =?us-ascii?Q?eQEzbz8wfLraQbRy2QcqNwqaa5M3nFjSG0d9aVJaXaH9H+RpeIW2HxM6Qbfd?=
 =?us-ascii?Q?qlJywjALHhGYRyvTKMmHUQ+CgP7+7gOyzvDzZDpabMoqMJkWwGHD5Rbtcf9n?=
 =?us-ascii?Q?0g/51H1OiCgn7II85mBVR+ZJClAiDJYZgmYuISrwwLJE1Cf/BC0Ug66POsmz?=
 =?us-ascii?Q?/BHAADWsLY9IRbGpbPKT6f5bpYdrv0ND6J+m51oBVdc9/m8u70DeeHje178V?=
 =?us-ascii?Q?IdsJ1Xihii7RIXQ0U3LloEshcYXLCJ7zO426jxnYk+uu0R/XNolObDHIEAgD?=
 =?us-ascii?Q?lg1FCNrI5myNoaTF/k8I8vS6kcJ2SRZpvoLYjm4mcgYREvJ/IHaQy6X9Gl8B?=
 =?us-ascii?Q?Yo0Hgg42j7QTAvT13Y8/XfxwBEq7nHou8e9G6baMUwsSubmtYBrPzvivyCea?=
 =?us-ascii?Q?Xeds+SL1xQ4hdkW+rSGvuyLK661QiFccBtDH9aVBhzMJ5YZ9eTHOHlBagYO8?=
 =?us-ascii?Q?hR00dmXUvhel8y6v6+f24IINJBrdoHi9Yu1T9yNyz+v4XJIgBqatXTqSZYDa?=
 =?us-ascii?Q?aim2R1gp5i4fBDnhltkIjorXEMMkUuIHxT3RxJZmyvicGPMENVM/U2GWywgT?=
 =?us-ascii?Q?xwm70FeWGOzUqPa1biDeT9lIamLRl6sL3bawstVgYd/EHYPlSgEQ4M5iToTG?=
 =?us-ascii?Q?t7C15Uai3wWgOXWGukegzlQ1Mq/sVp5XtuzqNS1ww5Vexurmpjor4eR/HSOi?=
 =?us-ascii?Q?hZnRx9XRjzVNsqsApCHTg8L20giV2s9sJx86XG3j1DRXfRZz7ES6zLvrliNf?=
 =?us-ascii?Q?DKCCQosxDVyW8nIDNc6b8iweIhpbNB6AEYOyLoPrHnNm4ytCb8lfHARKhIV5?=
 =?us-ascii?Q?06oW0YIHEHluMdJ/7DR+KeoBP8OeIie1Ch1eysea/5B6nRwh1Hb+UkyU1twU?=
 =?us-ascii?Q?BbMnCOd13TbzJ1BOrMKz07Q0MGcvyQWE2BqKrsbx+6gozRv8KpLO6aJroI+S?=
 =?us-ascii?Q?armvlUQlB/KHRmbo5F21VNWZweU6sGD7/J92gMn/chPm48PveHunoc5UsaZh?=
 =?us-ascii?Q?qjHIkw=3D=3D?=
X-OriginatorOrg: corigine.com
X-MS-Exchange-CrossTenant-Network-Message-Id: bcf58abf-066b-41d9-af91-08db61f408e1
X-MS-Exchange-CrossTenant-AuthSource: PH0PR13MB4842.namprd13.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 31 May 2023 16:28:15.4669
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: fe128f2c-073b-4c20-818e-7246a585940c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 5j+f4a3ht2ak211MSx41eyrMsTKms8zImT1JtyUdJ4iOLkvhxIHasIYhKdxkfkcqhLI202q43v7LV2Y/o1hY0D77gnO1njZhY34ij0W9LfA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR13MB5990
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

On Wed, May 31, 2023 at 03:44:56AM +0000, Ying Hsu wrote:
> L2CAP assumes that the locks conn->chan_lock and chan->lock are
> acquired in the order conn->chan_lock, chan->lock to avoid
> potential deadlock.
> For example, l2sock_shutdown acquires these locks in the order:
>   mutex_lock(&conn->chan_lock)
>   l2cap_chan_lock(chan)
> 
> However, l2cap_disconnect_req acquires chan->lock in
> l2cap_get_chan_by_scid first and then acquires conn->chan_lock
> before calling l2cap_chan_del. This means that these locks are
> acquired in unexpected order, which leads to potential deadlock:
>   l2cap_chan_lock(c)
>   mutex_lock(&conn->chan_lock)
> 
> This patch releases chan->lock before acquiring the conn_chan_lock
> to avoid the potential deadlock.
> 
> Fixes: ("a2a9339e1c9d Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}")

nit: this should be

Fixes: a2a9339e1c9d ("Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}")

...