Bluetooth: Fix a refcnt underflow problem for hci_conn

Commit Message

Ziyang Xuan (William) Oct. 4, 2023, 12:42 p.m. UTC

Syzbot reports a warning as follows:

WARNING: CPU: 1 PID: 26946 at net/bluetooth/hci_conn.c:619 hci_conn_timeout+0x122/0x210 net/bluetooth/hci_conn.c:619
...
Call Trace:
 <TASK>
 process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
 process_scheduled_works kernel/workqueue.c:2703 [inline]
 worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
 kthread+0x33c/0x440 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>

It is because the HCI_EV_SIMPLE_PAIR_COMPLETE event handler drops hci_conn
directly without check Simple Pairing whether be enabled. But the Simple
Pairing process can only be used if both sides have the support enabled
in the host stack.

Add hci_conn_ssp_enabled() for hci_conn in HCI_EV_IO_CAPA_REQUEST and
HCI_EV_SIMPLE_PAIR_COMPLETE event handlers to fix the problem.

Fixes: 0493684ed239 ("[Bluetooth] Disable disconnect timer during Simple Pairing")
Signed-off-by: Ziyang Xuan <[e-mail]>
---
 net/bluetooth/hci_event.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

[e-mail] Oct. 4, 2023, 1:25 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=789919

---Test result---

Test Summary:
CheckPatch                    PASS      0.81 seconds
GitLint                       FAIL      0.65 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      43.45 seconds
CheckAllWarning               PASS      45.87 seconds
CheckSparse                   WARNING   53.57 seconds
CheckSmatch                   WARNING   154.17 seconds
BuildKernel32                 PASS      44.99 seconds
TestRunnerSetup               PASS      652.20 seconds
TestRunner_l2cap-tester       PASS      37.78 seconds
TestRunner_iso-tester         PASS      94.68 seconds
TestRunner_bnep-tester        PASS      13.16 seconds
TestRunner_mgmt-tester        PASS      266.03 seconds
TestRunner_rfcomm-tester      PASS      20.14 seconds
TestRunner_sco-tester         PASS      23.29 seconds
TestRunner_ioctl-tester       PASS      23.21 seconds
TestRunner_mesh-tester        PASS      17.11 seconds
TestRunner_smp-tester         PASS      17.68 seconds
TestRunner_userchan-tester    PASS      13.96 seconds
IncrementalBuild              PASS      38.79 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: Fix a refcnt underflow problem for hci_conn

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
5: B1 Line exceeds max length (116>80): "WARNING: CPU: 1 PID: 26946 at net/bluetooth/hci_conn.c:619 hci_conn_timeout+0x122/0x210 net/bluetooth/hci_conn.c:619"
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: CheckSmatch - WARNING
Desc: Run smatch tool with source
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):


---
Regards,
Linux Bluetooth

[e-mail] Oct. 4, 2023, 7:30 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Wed, 4 Oct 2023 20:42:24 +0800 you wrote:
> Syzbot reports a warning as follows:
> 
> WARNING: CPU: 1 PID: 26946 at net/bluetooth/hci_conn.c:619 hci_conn_timeout+0x122/0x210 net/bluetooth/hci_conn.c:619
> ...
> Call Trace:
>  <TASK>
>  process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
>  process_scheduled_works kernel/workqueue.c:2703 [inline]
>  worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
>  kthread+0x33c/0x440 kernel/kthread.c:388
>  ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
>  </TASK>
> 
> [...]

Here is the summary with links:
  - Bluetooth: Fix a refcnt underflow problem for hci_conn
    https://git.kernel.org/bluetooth/bluetooth-next/c/6be21d987868

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 35f251041eeb..0b1487dcef24 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -5302,7 +5302,7 @@  static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
 	hci_dev_lock(hdev);
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-	if (!conn)
+	if (!conn || !hci_conn_ssp_enabled(conn))
 		goto unlock;
 
 	hci_conn_hold(conn);
@@ -5549,7 +5549,7 @@  static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
 	hci_dev_lock(hdev);
 
 	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
-	if (!conn)
+	if (!conn || !hci_conn_ssp_enabled(conn))
 		goto unlock;
 
 	/* Reset the authentication requirement to unknown */