Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

Commit Message

Zheng Wang March 8, 2023, 4:45 p.m. UTC

In btsdio_probe, the data->work is bound with btsdio_work. It will be 
started in btsdio_send_frame.

If the btsdio_remove runs with a unfinished work, there may be a race 
condition that hdev is freed but used in btsdio_work. Fix it by 
canceling the work before do cleanup in btsdio_remove.

Signed-off-by: Zheng Wang <[e-mail]>
---
 drivers/bluetooth/btsdio.c | 1 +
 1 file changed, 1 insertion(+)

Comments

[e-mail] March 8, 2023, 5:13 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=727958

---Test result---

Test Summary:
CheckPatch                    PASS      0.76 seconds
GitLint                       FAIL      0.83 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      39.44 seconds
CheckAllWarning               PASS      42.69 seconds
CheckSparse                   PASS      47.97 seconds
CheckSmatch                   PASS      129.08 seconds
BuildKernel32                 PASS      37.70 seconds
TestRunnerSetup               PASS      534.76 seconds
TestRunner_l2cap-tester       PASS      18.95 seconds
TestRunner_iso-tester         PASS      20.78 seconds
TestRunner_bnep-tester        PASS      6.83 seconds
TestRunner_mgmt-tester        PASS      129.65 seconds
TestRunner_rfcomm-tester      PASS      11.47 seconds
TestRunner_sco-tester         PASS      10.05 seconds
TestRunner_ioctl-tester       PASS      12.28 seconds
TestRunner_mesh-tester        PASS      9.09 seconds
TestRunner_smp-tester         PASS      9.82 seconds
TestRunner_userchan-tester    PASS      7.66 seconds
IncrementalBuild              PASS      35.26 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
3: B2 Line has trailing whitespace: "In btsdio_probe, the data->work is bound with btsdio_work. It will be "
6: B2 Line has trailing whitespace: "If the btsdio_remove runs with a unfinished work, there may be a race "
7: B2 Line has trailing whitespace: "condition that hdev is freed but used in btsdio_work. Fix it by "


---
Regards,
Linux Bluetooth

[e-mail] March 10, 2023, 12:20 a.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Thu,  9 Mar 2023 00:45:01 +0800 you wrote:
> In btsdio_probe, the data->work is bound with btsdio_work. It will be
> started in btsdio_send_frame.
> 
> If the btsdio_remove runs with a unfinished work, there may be a race
> condition that hdev is freed but used in btsdio_work. Fix it by
> canceling the work before do cleanup in btsdio_remove.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
    https://git.kernel.org/bluetooth/bluetooth-next/c/61115bb7574e

You are awesome, thank you!

Patch

diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index 795be33f2892..f19d31ee37ea 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -357,6 +357,7 @@  static void btsdio_remove(struct sdio_func *func)
 	if (!data)
 		return;
 
+	cancel_work_sync(&data->work);
 	hdev = data->hdev;
 
 	sdio_set_drvdata(func, NULL);