Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sat, 15 Jul 2023 00:17:02 +0800
From:   joeyli <jlee@suse.com>
To:     Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc:     Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        "David S . Miller" <davem@davemloft.net>,
        linux-kernel@vger.kernel.org, linux-bluetooth@vger.kernel.org,
        jlee@suse.com
Subject: Re: [PATCH] Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in
 HCIUARTGETPROTO
Message-ID: <20230714161702.GJ5866@linux-l9pv.suse>
References: <20230714160854.20562-1-jlee@suse.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230714160854.20562-1-jlee@suse.com>
User-Agent: Mutt/1.11.4 (2019-03-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?9VOgDZS5QiMmPigKEO8YWT6rrCLQ9WNNHtYRgJZWq22kU+Zre5Ptb+huTI+h?=
 =?us-ascii?Q?KT0gA4MWf7OSP6RUhtLagTBYZ7A3sICKyjS9g5lN79gZcs4C1sWD9dUbxb4c?=
 =?us-ascii?Q?IaMbLv8vbpbniI0XwM3wb3bDv71kPFsoYFcHAXSnhrfPIQIdOey1wObAl5N9?=
 =?us-ascii?Q?GITP8aCN4/WQJvpjK7UkvqgwLuYnh08Jxha7X/EW0oLQn9pSdTYz/NLNrIfG?=
 =?us-ascii?Q?nYiP5+4GU5qzljFsXpFTbNYQBuScVsd/2Y7omhbQW97zAduT1+ZlB9JNDT5P?=
 =?us-ascii?Q?ae4vTIdCeNFtvPdFXnwhVe4QK42utp9B8IF/tzh1Ws3sg3tUDXaoKqC6mee7?=
 =?us-ascii?Q?sIqEHZotfyKUrtsl+nhskbosJWk7JD8Hy6JVLHZ8jBkUI0I2+GD329K6b8vy?=
 =?us-ascii?Q?Dsg09VdoM0v1FRIJkg2oAwUxhxBpJyoBhMMhRyEVMGDqKUIA7ZBJ2ZZPSaxl?=
 =?us-ascii?Q?IbkeND07X3CBex1q35wrMewLEpmEj3CIIyXDI144d+1N0vzqEKxgKjRZKB6+?=
 =?us-ascii?Q?jE6lLtu/RrP8VMzMWfkk1ewIWAXze8PBBICANmhJPSf5eenLdQGJGTQqGJxT?=
 =?us-ascii?Q?vFLcegRKjSrN2vOIIlreZe4hh9doUownI2Q4Wafu1vyCvxv1oVWweE0EhG8g?=
 =?us-ascii?Q?pqCSxTb8j718xp3O5HKQNjyXQGCYFYVukcZPrqWOBWlJS28PE5/HLScSDchi?=
 =?us-ascii?Q?el3QXD/3QwQjNC4ySHw0eXQwLx+HpdzzM/TMr1d9JZbJMeglyRXzp9yEUziT?=
 =?us-ascii?Q?zUpyXAEBk83s/FQdad5QbNyTDT9J0SoCdhDb8xKl6+O1gsWNDLp7NzQNpkD8?=
 =?us-ascii?Q?KyHdjBJIrXBWedzYxl7sCYpmEuFabqju3wc2qHiK/+hJN/Uq2zEFgLMUxdsw?=
 =?us-ascii?Q?zZJwTq0DnMrMV2Re6R8cgYRQ4jMAD8Sa2hMdl3rpZZv7XXjvOsWpa9uOCcbP?=
 =?us-ascii?Q?fkj/4TJVCL0je13u52YGtFO4nvPow3RiqSaseO3HaRtkiOqg/6LN1Lft4AOC?=
 =?us-ascii?Q?S7c9qUrEKF6/wfJvrj8WD5HuTrmyO9qaDfBCdrtyBFLrObYDUNlCv2aWTUtD?=
 =?us-ascii?Q?ntxUMf0z2Vxh1htD5GShFDMKlbu9tw8KoCqH5xKn/R7Lf7QhKAaRI0bSDPl8?=
 =?us-ascii?Q?EkVvuSVnABSu7Fdtj4MvJtjRP+VjIhl2bQ/Vz/vPPil9xngpgO6Pr5L6Y6S2?=
 =?us-ascii?Q?Jz+VtayZVHa0mD6NTAWA3G2KZL79P4aJhxSbyzdFHxEo9xbLVgsn1nvPGSR6?=
 =?us-ascii?Q?Zn3dPEnacyla4vEu/U2bKBiQe8QiHmSvaxYM9ZgE2U9bWmhLYBjckna3fpuQ?=
 =?us-ascii?Q?JYum10+pQmPgJXNB4Kpu8jOWiZbt4I1KnwLT+ZcpYCDfhpYrDuD/XB2OCPY5?=
 =?us-ascii?Q?Px8vbjc5yVjgJH1ecvtfLQ6T+Kw2nXKT8+XYshGJmWUoScvMvkC6Se0QgLKz?=
 =?us-ascii?Q?jNVFLxDf2KYQqBhGy1hirlIajWVRMDEzuJTJ0k1LyFqgGn/MNpiqhDqlE2wz?=
 =?us-ascii?Q?7FJgUOWKtNisdIsENqENFmWue43OVKAgWb/P5kiSzcpSFecVzURcysw2I8p1?=
 =?us-ascii?Q?dITMEpEAAJFfK997WjQ=3D?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c4d26d2c-768e-41cf-48b6-08db8485c963
X-MS-Exchange-CrossTenant-AuthSource: VI1PR04MB7165.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 14 Jul 2023 16:17:14.8338
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: QzYfRswiOMX1GoHonzGyCQspOaiuVkJKG9onaw0RHrCGBukmDs22IOqjN3hrEvdP
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR04MB7606
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,
        RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS,T_SCC_BODY_TEXT_LINE,
        URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Hi Luiz Augusto von Dentz and all experts

Sorry for I send out a duplicate patch again. Just ignore this
duplicate patch, please.

Thanks!
Joey Lee

On Sat, Jul 15, 2023 at 12:08:54AM +0800, Lee, Chun-Yi wrote:
> This patch adds code to check HCI_UART_PROTO_READY flag before
> accessing hci_uart->proto. It fixs the race condition in
> hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO.
> This issue bug found by Yu Hao and Weiteng Chen:
> 
> BUG: general protection fault in hci_uart_tty_ioctl [1]
> 
> The information of C reproducer can also reference the link [2]
> 
> Reported-by: Yu Hao <yhao016@ucr.edu>
> Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDeCO2g@mail.gmail.com/ [1]
> Reported-by: Weiteng Chen <wchen130@ucr.edu>
> Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4Keh2ow@mail.gmail.com/T/ [2]
> Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
> ---
>  drivers/bluetooth/hci_ldisc.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
> index efdda2c3fce8..a76eb98c0047 100644
> --- a/drivers/bluetooth/hci_ldisc.c
> +++ b/drivers/bluetooth/hci_ldisc.c
> @@ -770,7 +770,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, unsigned int cmd,
>  		break;
>  
>  	case HCIUARTGETPROTO:
> -		if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
> +		if (test_bit(HCI_UART_PROTO_SET, &hu->flags) &&
> +		    test_bit(HCI_UART_PROTO_READY, &hu->flags))
>  			err = hu->proto->id;
>  		else
>  			err = -EUNATCH;
> -- 
> 2.35.3