mirror of
https://github.com/torvalds/linux
synced 2024-10-15 07:47:34 +00:00
a239110ee8
In hci_abort_conn_sync it is possible that conn is deleted concurrently
by something else, also e.g. when waiting for hdev->lock. This causes
double deletion of the conn, so UAF or conn_hash.list corruption.
Fix by having all code paths check that the connection is still in
conn_hash before deleting it, while holding hdev->lock which prevents
any races.
Log (when powering off while BAP streaming, occurs rarely):
=======================================================================
kernel BUG at lib/list_debug.c:56!
...
? __list_del_entry_valid (lib/list_debug.c:56)
hci_conn_del (net/bluetooth/hci_conn.c:154) bluetooth
hci_abort_conn_sync (net/bluetooth/hci_sync.c:5415) bluetooth
? __pfx_hci_abort_conn_sync+0x10/0x10 [bluetooth]
? lock_release+0x1d5/0x3c0
? hci_disconnect_all_sync.constprop.0+0xb2/0x230 [bluetooth]
? __pfx_lock_release+0x10/0x10
? __kmem_cache_free+0x14d/0x2e0
hci_disconnect_all_sync.constprop.0+0xda/0x230 [bluetooth]
? __pfx_hci_disconnect_all_sync.constprop.0+0x10/0x10 [bluetooth]
? hci_clear_adv_sync+0x14f/0x170 [bluetooth]
? __pfx_set_powered_sync+0x10/0x10 [bluetooth]
hci_set_powered_sync+0x293/0x450 [bluetooth]
=======================================================================
Fixes:
|
||
---|---|---|
.. | ||
bnep | ||
cmtp | ||
hidp | ||
rfcomm | ||
6lowpan.c | ||
a2mp.c | ||
a2mp.h | ||
af_bluetooth.c | ||
amp.c | ||
amp.h | ||
aosp.c | ||
aosp.h | ||
coredump.c | ||
ecdh_helper.c | ||
ecdh_helper.h | ||
eir.c | ||
eir.h | ||
hci_codec.c | ||
hci_codec.h | ||
hci_conn.c | ||
hci_core.c | ||
hci_debugfs.c | ||
hci_debugfs.h | ||
hci_event.c | ||
hci_request.c | ||
hci_request.h | ||
hci_sock.c | ||
hci_sync.c | ||
hci_sysfs.c | ||
iso.c | ||
Kconfig | ||
l2cap_core.c | ||
l2cap_sock.c | ||
leds.c | ||
leds.h | ||
lib.c | ||
Makefile | ||
mgmt.c | ||
mgmt_config.c | ||
mgmt_config.h | ||
mgmt_util.c | ||
mgmt_util.h | ||
msft.c | ||
msft.h | ||
sco.c | ||
selftest.c | ||
selftest.h | ||
smp.c | ||
smp.h |