From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>,
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
Sasha Levin <sashal@kernel.org>,
linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 45/74] Bluetooth: avoid circular locks in sco_sock_connect
Date: Thu, 9 Sep 2021 07:56:57 -0400 [thread overview]
Message-ID: <20210909115726.149004-45-sashal@kernel.org> (raw)
In-Reply-To: <20210909115726.149004-1-sashal@kernel.org>
From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
[ Upstream commit 734bc5ff783115aa3164f4e9dd5967ae78e0a8ab ]
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 39 ++++++++++++++++-----------------------
1 file changed, 16 insertions(+), 23 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index e30151e81566..8345d17e98be 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -236,44 +236,32 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
return err;
}
-static int sco_connect(struct sock *sk)
+static int sco_connect(struct hci_dev *hdev, struct sock *sk)
{
struct sco_conn *conn;
struct hci_conn *hcon;
- struct hci_dev *hdev;
int err, type;
BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
- hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
- if (!hdev)
- return -EHOSTUNREACH;
-
- hci_dev_lock(hdev);
-
if (lmp_esco_capable(hdev) && !disable_esco)
type = ESCO_LINK;
else
type = SCO_LINK;
if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
- (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev))) {
- err = -EOPNOTSUPP;
- goto done;
- }
+ (!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)))
+ return -EOPNOTSUPP;
hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
sco_pi(sk)->setting);
- if (IS_ERR(hcon)) {
- err = PTR_ERR(hcon);
- goto done;
- }
+ if (IS_ERR(hcon))
+ return PTR_ERR(hcon);
conn = sco_conn_add(hcon);
if (!conn) {
hci_conn_drop(hcon);
- err = -ENOMEM;
- goto done;
+ return -ENOMEM;
}
/* Update source addr of the socket */
@@ -281,7 +269,7 @@ static int sco_connect(struct sock *sk)
err = sco_chan_add(conn, sk, NULL);
if (err)
- goto done;
+ return err;
if (hcon->state == BT_CONNECTED) {
sco_sock_clear_timer(sk);
@@ -291,9 +279,6 @@ static int sco_connect(struct sock *sk)
sco_sock_set_timer(sk, sk->sk_sndtimeo);
}
-done:
- hci_dev_unlock(hdev);
- hci_dev_put(hdev);
return err;
}
@@ -577,6 +562,7 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
{
struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
struct sock *sk = sock->sk;
+ struct hci_dev *hdev;
int err;
BT_DBG("sk %p", sk);
@@ -591,12 +577,19 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen
if (sk->sk_type != SOCK_SEQPACKET)
return -EINVAL;
+ hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR);
+ if (!hdev)
+ return -EHOSTUNREACH;
+ hci_dev_lock(hdev);
+
lock_sock(sk);
/* Set destination address and psm */
bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
- err = sco_connect(sk);
+ err = sco_connect(hdev, sk);
+ hci_dev_unlock(hdev);
+ hci_dev_put(hdev);
if (err)
goto done;
--
2.30.2
next prev parent reply other threads:[~2021-09-09 13:37 UTC|newest]
Thread overview: 77+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-09 11:56 [PATCH AUTOSEL 4.19 01/74] media: dib8000: rewrite the init prbs logic Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 02/74] crypto: mxs-dcp - Use sg_mapping_iter to copy data Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 03/74] PCI: Use pci_update_current_state() in pci_enable_device_flags() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 04/74] tipc: keep the skb in rcv queue until the whole data is read Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 05/74] iio: dac: ad5624r: Fix incorrect handling of an optional regulator Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 06/74] ARM: dts: qcom: apq8064: correct clock names Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 07/74] video: fbdev: kyro: fix a DoS bug by restricting user input Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 08/74] netlink: Deal with ESRCH error in nlmsg_notify() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 09/74] Smack: Fix wrong semantics in smk_access_entry() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 10/74] usb: host: fotg210: fix the endpoint's transactional opportunities calculation Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 11/74] usb: host: fotg210: fix the actual_length of an iso packet Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 12/74] usb: gadget: u_ether: fix a potential null pointer dereference Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 13/74] usb: gadget: composite: Allow bMaxPower=0 if self-powered Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 14/74] staging: board: Fix uninitialized spinlock when attaching genpd Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 15/74] tty: serial: jsm: hold port lock when reporting modem line changes Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 16/74] drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 17/74] bpf/tests: Fix copy-and-paste error in double word test Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 18/74] bpf/tests: Do not PASS tests without actually testing the result Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 19/74] video: fbdev: asiliantfb: Error out if 'pixclock' equals zero Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 20/74] video: fbdev: kyro: " Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 21/74] video: fbdev: riva: " Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 22/74] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 23/74] flow_dissector: Fix out-of-bounds warnings Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 24/74] s390/jump_label: print real address in a case of a jump label bug Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 25/74] serial: 8250: Define RX trigger levels for OxSemi 950 devices Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 26/74] xtensa: ISS: don't panic in rs_init Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 27/74] hvsi: don't panic on tty_register_driver failure Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 28/74] serial: 8250_pci: make setup_port() parameters explicitly unsigned Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 29/74] staging: ks7010: Fix the initialization of the 'sleep_status' structure Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 30/74] samples: bpf: Fix tracex7 error raised on the missing argument Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 31/74] ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 32/74] Bluetooth: skip invalid hci_sync_conn_complete_evt Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 33/74] bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 34/74] ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 35/74] bpf: Fix off-by-one in tail call count limiting Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 36/74] media: imx258: Rectify mismatch of VTS value Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 37/74] media: imx258: Limit the max analogue gain to 480 Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 38/74] media: v4l2-dv-timings.c: fix wrong condition in two for-loops Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 39/74] media: TDA1997x: fix tda1997x_query_dv_timings() return value Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 40/74] media: tegra-cec: Handle errors of clk_prepare_enable() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 41/74] ARM: dts: imx53-ppd: Fix ACHC entry Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 42/74] arm64: dts: qcom: sdm660: use reg value for memory node Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 43/74] net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 44/74] Bluetooth: schedule SCO timeouts with delayed_work Sasha Levin
2021-09-09 11:56 ` Sasha Levin [this message]
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 46/74] gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port() Sasha Levin
2021-09-09 11:56 ` [PATCH AUTOSEL 4.19 47/74] ARM: tegra: tamonten: Fix UART pad setting Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 48/74] ACPICA: iASL: Fix for WPBT table with no command-line arguments Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 49/74] Bluetooth: Fix handling of LE Enhanced Connection Complete Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 50/74] serial: sh-sci: fix break handling for sysrq Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 51/74] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 52/74] rpc: fix gss_svc_init cleanup on failure Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 53/74] staging: rts5208: Fix get_ms_information() heap buffer size Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 54/74] gfs2: Don't call dlm after protocol is unmounted Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 55/74] btrfs: subpage: check if there are compressed extents inside one page Sasha Levin
2021-09-09 13:01 ` David Sterba
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 56/74] btrfs: subpage: fix race between prepare_pages() and btrfs_releasepage() Sasha Levin
2021-09-09 13:01 ` David Sterba
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 57/74] ASoC: intel: atom: Revert PCM buffer address setup workaround again Sasha Levin
2021-09-09 12:06 ` Takashi Iwai
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 58/74] of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 59/74] mmc: sdhci-of-arasan: Check return value of non-void funtions Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 60/74] mmc: rtsx_pci: Fix long reads when clock is prescaled Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 61/74] selftests/bpf: Enlarge select() timeout for test_maps Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 62/74] mmc: core: Return correct emmc response in case of ioctl error Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 63/74] cifs: fix wrong release in sess_alloc_buffer() failed path Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 64/74] Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set" Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 65/74] usb: musb: musb_dsps: request_irq() after initializing musb Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 66/74] usbip: give back URBs for unsent unlink requests during cleanup Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 67/74] usbip:vhci_hcd USB port can get stuck in the disabled state Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 68/74] ASoC: rockchip: i2s: Fix regmap_ops hang Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 69/74] ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 70/74] parport: remove non-zero check on count Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 71/74] ath9k: fix OOB read ar9300_eeprom_restore_internal Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 72/74] ath9k: fix sleeping in atomic context Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 73/74] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-09-09 11:57 ` [PATCH AUTOSEL 4.19 74/74] net: w5100: check return value after calling platform_get_resource() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210909115726.149004-45-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=desmondcheongzx@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.von.dentz@intel.com \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).