| Context |
Check |
Description |
| tedd_an/pre-ci_am |
success
|
Success
|
| tedd_an/checkpatch |
success
|
Checkpatch PASS
|
| tedd_an/gitlint |
success
|
Gitlint PASS
|
| tedd_an/subjectprefix |
success
|
PASS
|
| tedd_an/buildkernel |
success
|
Build Kernel PASS
|
| tedd_an/buildkernel32 |
success
|
Build Kernel32 PASS
|
| tedd_an/incremental_build |
success
|
Pass
|
| tedd_an/testrunnersetup |
success
|
Test Runner Setup PASS
|
| tedd_an/testrunnerl2cap-tester |
success
|
Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnerbnep-tester |
success
|
Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnermgmt-tester |
success
|
Total: 493, Passed: 493 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnerrfcomm-tester |
success
|
Total: 10, Passed: 10 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnersco-tester |
success
|
Total: 12, Passed: 12 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnersmp-tester |
success
|
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunneruserchan-tester |
success
|
Total: 4, Passed: 4 (100.0%), Failed: 0, Not Run: 0
|
@@ -3222,10 +3222,12 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
return;
}
+ hci_dev_lock(hdev);
+
if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
BDADDR_BREDR)) {
hci_reject_conn(hdev, &ev->bdaddr);
- return;
+ goto unlock;
}
/* Require HCI_CONNECTABLE or an accept list entry to accept the
@@ -3237,13 +3239,11 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
!hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
BDADDR_BREDR)) {
hci_reject_conn(hdev, &ev->bdaddr);
- return;
+ goto unlock;
}
/* Connection accepted */
- hci_dev_lock(hdev);
-
ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
if (ie)
memcpy(ie->data.dev_class, ev->dev_class, 3);
@@ -3255,8 +3255,7 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
HCI_ROLE_SLAVE);
if (!conn) {
bt_dev_err(hdev, "no memory for new connection");
- hci_dev_unlock(hdev);
- return;
+ goto unlock;
}
}
@@ -3296,6 +3295,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
conn->state = BT_CONNECT2;
hci_connect_cfm(conn, 0);
}
+
+ return;
+unlock:
+ hci_dev_unlock(hdev);
}
static u8 hci_to_mgmt_reason(u8 err)
All accesses (both reads and modifications) to hdev->{accept,reject}_list are protected by hdev lock, except the ones in hci_conn_request_evt. This can cause a race condition in the form of a list corruption. The solution is to protect these lists in hci_conn_request_evt as well. I was unable to find the exact commit that introduced the issue for the reject list, I was only able to find it for the accept list. Fixes: a55bd29d5227 ("Bluetooth: Add white list lookup for incoming connection requests") Signed-off-by: Niels Dossche <dossche.niels@gmail.com> --- Changes in v2: - edited commit message to exclude note - used an exit goto label instead Note: I am currently working on a static analyser to detect missing locks using type-based static analysis as my master's thesis in order to obtain my master's degree. If you would like to have more details, please let me know. This was a reported case. I manually verified the report by looking at the code, so that I do not send wrong information or patches. After concluding that this seems to be a true positive, I created this patch. I have both compile-tested this patch and runtime-tested this patch on x86_64. The effect on a running system could be a potential race condition in exceptional cases. This issue was found on Linux v5.17.1. net/bluetooth/hci_event.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)