Re: [PATCH v2] Bluetooth: Fix l2cap_disconnect_req deadlock

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

Hi Simon, Ying,

On Tue, May 23, 2023 at 3:04 AM Simon Horman <simon.horman@corigine.com> wrote:
>
> On Mon, May 22, 2023 at 11:41:51PM +0000, Ying Hsu wrote:
> > L2CAP assumes that the locks conn->chan_lock and chan->lock are
> > acquired in the order conn->chan_lock, chan->lock to avoid
> > potential deadlock.
> > For example, l2sock_shutdown acquires these locks in the order:
> >   mutex_lock(&conn->chan_lock)
> >   l2cap_chan_lock(chan)
> >
> > However, l2cap_disconnect_req acquires chan->lock in
> > l2cap_get_chan_by_scid first and then acquires conn->chan_lock
> > before calling l2cap_chan_del. This means that these locks are
> > acquired in unexpected order, which leads to potential deadlock:
> >   l2cap_chan_lock(c)
> >   mutex_lock(&conn->chan_lock)
> >
> > This patch uses __l2cap_get_chan_by_scid to replace
> > l2cap_get_chan_by_scid and adjusts the locking order to avoid the
> > potential deadlock.

This needs the fixes tag so we can backport it properly.

> > Signed-off-by: Ying Hsu <yinghsu@chromium.org>
> > ---
> > This commit has been tested on a Chromebook device.
> >
> > Changes in v2:
> > - Adding the prefix "Bluetooth:" to subject line.
> >
> >  net/bluetooth/l2cap_core.c | 26 ++++++++++++++++++++------
> >  1 file changed, 20 insertions(+), 6 deletions(-)
> >
> > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > index 376b523c7b26..8f08192b8fb1 100644
> > --- a/net/bluetooth/l2cap_core.c
> > +++ b/net/bluetooth/l2cap_core.c
> > @@ -4651,8 +4651,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
> >
> >       BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
> >
> > -     chan = l2cap_get_chan_by_scid(conn, dcid);
> > +     mutex_lock(&conn->chan_lock);
> > +     chan = __l2cap_get_chan_by_scid(conn, dcid);
> > +     if (chan) {
> > +             chan = l2cap_chan_hold_unless_zero(chan);
> > +             if (chan)
> > +                     l2cap_chan_lock(chan);
> > +     }
> > +
> >       if (!chan) {
> > +             mutex_unlock(&conn->chan_lock);
> >               cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
> >               return 0;
> >       }
>
> Hi Ying,
>
> The conditional setting of chan and calling l2cap_chan_lock()
> is both non-trivial and repeated. It seems that it ought to be
> in a helper.
>
> Something like this (I'm sure a better function name can be chosen):
>
>         chan = __l2cap_get_and_lock_chan_by_scid(conn, dcid);
>         if (!chan) {
>                 ...
>         }
>
>         ...

Or perhaps we could do something like l2cap_del_chan_by_scid:

https://gist.github.com/Vudentz/e513859ecb31e79c947dfcb4b5c60453

-- 
Luiz Augusto von Dentz