From: Luiz Augusto von Dentz <luiz.dentz@gmail.com> To: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> Cc: Marcel Holtmann <marcel@holtmann.org>, Johan Hedberg <johan.hedberg@gmail.com>, "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, Lin Ma <linma@zju.edu.cn>, "open list:NETWORKING [GENERAL]" <netdev@vger.kernel.org> Subject: Re: [PATCH v3] Bluetooth: call lock_sock() outside of spinlock section Date: Wed, 14 Jul 2021 12:20:15 -0700 [thread overview] Message-ID: <CABBYNZJKWktRo1pCMdafAZ22sE2ZbZeMuFOO+tHUxOtEtTDTeA@mail.gmail.com> (raw) In-Reply-To: <48d66166-4d39-4fe2-3392-7e0c84b9bdb3@i-love.sakura.ne.jp> Hi Tetsuo, On Tue, Jul 13, 2021 at 4:28 AM Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp> wrote: > > syzbot is hitting might_sleep() warning at hci_sock_dev_event() due to > calling lock_sock() with rw spinlock held [1]. Among three possible > approaches [2], this patch chose holding a refcount via sock_hold() and > revalidating the element via sk_hashed(). > > Link: https://syzkaller.appspot.com/bug?extid=a5df189917e79d5e59c9 [1] > Link: https://lkml.kernel.org/r/05535d35-30d6-28b6-067e-272d01679d24@i-love.sakura.ne.jp [2] > Reported-by: syzbot <syzbot+a5df189917e79d5e59c9@syzkaller.appspotmail.com> > Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> > Tested-by: syzbot <syzbot+a5df189917e79d5e59c9@syzkaller.appspotmail.com> > Fixes: e305509e678b3a4a ("Bluetooth: use correct lock to prevent UAF of hdev object") > --- > Changes in v3: > Don't use unlocked hci_pi(sk)->hdev != hdev test, for it is racy. > No need to defer hci_dev_put(hdev), for it can't be the last reference. > > Changes in v2: > Take hci_sk_list.lock for write in case bt_sock_unlink() is called after > sk_hashed(sk) test, and defer hci_dev_put(hdev) till schedulable context. How about we revert back to use bh_lock_sock_nested but use local_bh_disable like the following patch: https://patchwork.kernel.org/project/bluetooth/patch/20210713162838.693266-1-desmondcheongzx@gmail.com/ > net/bluetooth/hci_sock.c | 30 +++++++++++++++++++++++++++++- > 1 file changed, 29 insertions(+), 1 deletion(-) > > diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c > index b04a5a02ecf3..786a06a232fd 100644 > --- a/net/bluetooth/hci_sock.c > +++ b/net/bluetooth/hci_sock.c > @@ -760,10 +760,18 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) > struct sock *sk; > > /* Detach sockets from device */ > +restart: > read_lock(&hci_sk_list.lock); > sk_for_each(sk, &hci_sk_list.head) { > + /* This sock_hold(sk) is safe, for bt_sock_unlink(sk) > + * is not called yet. > + */ > + sock_hold(sk); > + read_unlock(&hci_sk_list.lock); > lock_sock(sk); > - if (hci_pi(sk)->hdev == hdev) { > + write_lock(&hci_sk_list.lock); > + /* Check that bt_sock_unlink(sk) is not called yet. */ > + if (sk_hashed(sk) && hci_pi(sk)->hdev == hdev) { > hci_pi(sk)->hdev = NULL; > sk->sk_err = EPIPE; > sk->sk_state = BT_OPEN; > @@ -771,7 +779,27 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) > > hci_dev_put(hdev); > } > + write_unlock(&hci_sk_list.lock); > release_sock(sk); > + read_lock(&hci_sk_list.lock); > + /* If bt_sock_unlink(sk) is not called yet, we can > + * continue iteration. We can use __sock_put(sk) here > + * because hci_sock_release() will call sock_put(sk) > + * after bt_sock_unlink(sk). > + */ > + if (sk_hashed(sk)) { > + __sock_put(sk); > + continue; > + } > + /* Otherwise, we need to restart iteration, for the > + * next socket pointed by sk->next might be already > + * gone. We can't use __sock_put(sk) here because > + * hci_sock_release() might have already called > + * sock_put(sk) after bt_sock_unlink(sk). > + */ > + read_unlock(&hci_sk_list.lock); > + sock_put(sk); > + goto restart; > } > read_unlock(&hci_sk_list.lock); > } > -- > 2.18.4 > -- Luiz Augusto von Dentz
next prev parent reply other threads:[~2021-07-14 19:20 UTC|newest] Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-06-27 13:11 [PATCH] " Tetsuo Handa 2021-06-27 14:05 ` bluez.test.bot 2021-07-07 9:43 ` [PATCH v2] " Tetsuo Handa 2021-07-07 10:08 ` [v2] " bluez.test.bot 2021-07-07 18:20 ` [PATCH v2] " Luiz Augusto von Dentz 2021-07-07 23:33 ` Tetsuo Handa 2021-07-08 1:00 ` LinMa 2021-07-09 13:50 ` Tetsuo Handa 2021-07-10 13:34 ` Tetsuo Handa 2021-07-08 7:16 ` [v2] " bluez.test.bot 2021-07-13 11:27 ` [PATCH v3] " Tetsuo Handa 2021-07-13 11:57 ` [v3] " bluez.test.bot 2021-07-14 19:20 ` Luiz Augusto von Dentz [this message] 2021-07-15 3:03 ` Re: [PATCH v3] " LinMa 2021-07-16 3:47 ` Desmond Cheong Zhi Xi 2021-07-16 4:11 ` Desmond Cheong Zhi Xi 2021-07-16 14:48 ` Tetsuo Handa 2021-07-16 15:26 ` LinMa 2021-07-17 15:41 ` Yet Another Patch for CVE-2021-3573 LinMa 2021-07-17 15:45 ` LinMa 2021-07-22 9:36 ` [PATCH v3] Bluetooth: call lock_sock() outside of spinlock section Tetsuo Handa 2021-07-22 4:47 ` LinMa 2021-07-22 5:16 ` Tetsuo Handa
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CABBYNZJKWktRo1pCMdafAZ22sE2ZbZeMuFOO+tHUxOtEtTDTeA@mail.gmail.com \ --to=luiz.dentz@gmail.com \ --cc=davem@davemloft.net \ --cc=johan.hedberg@gmail.com \ --cc=kuba@kernel.org \ --cc=linma@zju.edu.cn \ --cc=linux-bluetooth@vger.kernel.org \ --cc=marcel@holtmann.org \ --cc=netdev@vger.kernel.org \ --cc=penguin-kernel@i-love.sakura.ne.jp \ --subject='Re: [PATCH v3] Bluetooth: call lock_sock() outside of spinlock section' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.