diff mbox series

[v1] Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating

Message ID 20241204165849.392564-1-luiz.dentz@gmail.com (mailing list archive)
State Accepted
Commit 042ca30229a0f291ce30718bd9d4fb337435e3d9
Headers show
Series [v1] Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/SubjectPrefix success Gitlint PASS
tedd_an/BuildKernel success BuildKernel PASS
tedd_an/CheckAllWarning success CheckAllWarning PASS
tedd_an/CheckSparse warning CheckSparse WARNING net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
tedd_an/BuildKernel32 success BuildKernel32 PASS
tedd_an/TestRunnerSetup success TestRunnerSetup PASS
tedd_an/TestRunner_l2cap-tester success TestRunner PASS
tedd_an/TestRunner_iso-tester fail TestRunner_iso-tester: WARNING: possible circular locking dependency detected
tedd_an/TestRunner_bnep-tester success TestRunner PASS
tedd_an/TestRunner_mgmt-tester fail TestRunner_mgmt-tester: Total: 492, Passed: 487 (99.0%), Failed: 1, Not Run: 4
tedd_an/TestRunner_rfcomm-tester success TestRunner PASS
tedd_an/TestRunner_sco-tester success TestRunner PASS
tedd_an/TestRunner_ioctl-tester success TestRunner PASS
tedd_an/TestRunner_mesh-tester success TestRunner PASS
tedd_an/TestRunner_smp-tester success TestRunner PASS
tedd_an/TestRunner_userchan-tester success TestRunner PASS

Commit Message

Luiz Augusto von Dentz Dec. 4, 2024, 4:58 p.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is
not safe since for the most part entries fetched this way shall be
treated as rcu_dereference:

	Note that the value returned by rcu_dereference() is valid
	only within the enclosing RCU read-side critical section [1]_.
	For example, the following is **not** legal::

		rcu_read_lock();
		p = rcu_dereference(head.next);
		rcu_read_unlock();
		x = p->address;	/* BUG!!! */
		rcu_read_lock();
		y = p->data;	/* BUG!!! */
		rcu_read_unlock();

Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/hci_event.c | 33 +++++++++++----------------------
 1 file changed, 11 insertions(+), 22 deletions(-)

Comments

Luiz Augusto von Dentz Dec. 4, 2024, 5:02 p.m. UTC | #1 
On Wed, Dec 4, 2024 at 11:58 AM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is
> not safe since for the most part entries fetched this way shall be
> treated as rcu_dereference:
>
>         Note that the value returned by rcu_dereference() is valid
>         only within the enclosing RCU read-side critical section [1]_.
>         For example, the following is **not** legal::
>
>                 rcu_read_lock();
>                 p = rcu_dereference(head.next);
>                 rcu_read_unlock();
>                 x = p->address; /* BUG!!! */
>                 rcu_read_lock();
>                 y = p->data;    /* BUG!!! */
>                 rcu_read_unlock();
>
> Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  net/bluetooth/hci_event.c | 33 +++++++++++----------------------
>  1 file changed, 11 insertions(+), 22 deletions(-)
>
> diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
> index aca121408369..0d59f2cfb9a4 100644
> --- a/net/bluetooth/hci_event.c
> +++ b/net/bluetooth/hci_event.c
> @@ -6872,38 +6872,27 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
>                 return;
>
>         hci_dev_lock(hdev);
> -       rcu_read_lock();
>
>         /* Connect all BISes that are bound to the BIG */
> -       list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
> -               if (bacmp(&conn->dst, BDADDR_ANY) ||
> -                   conn->type != ISO_LINK ||
> -                   conn->iso_qos.bcast.big != ev->handle)
> +       while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
> +                                                     BT_BOUND))) {
> +               if (ev->status) {
> +                       hci_connect_cfm(conn, ev->status);
> +                       hci_conn_del(conn);
>                         continue;
> +               }
>
>                 if (hci_conn_set_handle(conn,
>                                         __le16_to_cpu(ev->bis_handle[i++])))
>                         continue;
>
> -               if (!ev->status) {
> -                       conn->state = BT_CONNECTED;
> -                       set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
> -                       rcu_read_unlock();
> -                       hci_debugfs_create_conn(conn);
> -                       hci_conn_add_sysfs(conn);
> -                       hci_iso_setup_path(conn);
> -                       rcu_read_lock();
> -                       continue;
> -               }
> -
> -               hci_connect_cfm(conn, ev->status);
> -               rcu_read_unlock();
> -               hci_conn_del(conn);
> -               rcu_read_lock();
> +               conn->state = BT_CONNECTED;
> +               set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
> +               hci_debugfs_create_conn(conn);
> +               hci_conn_add_sysfs(conn);
> +               hci_iso_setup_path(conn);
>         }
>
> -       rcu_read_unlock();
> -
>         if (!ev->status && !i)
>                 /* If no BISes have been connected for the BIG,
>                  * terminate. This is in case all bound connections
> --
> 2.47.1
>
bluez.test.bot@gmail.com Dec. 4, 2024, 5:31 p.m. UTC | #2 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=914654

---Test result---

Test Summary:
CheckPatch                    PENDING   0.40 seconds
GitLint                       PENDING   0.40 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      25.26 seconds
CheckAllWarning               PASS      27.87 seconds
CheckSparse                   WARNING   31.48 seconds
BuildKernel32                 PASS      25.05 seconds
TestRunnerSetup               PASS      443.48 seconds
TestRunner_l2cap-tester       PASS      20.63 seconds
TestRunner_iso-tester         FAIL      30.80 seconds
TestRunner_bnep-tester        PASS      4.84 seconds
TestRunner_mgmt-tester        FAIL      122.16 seconds
TestRunner_rfcomm-tester      PASS      7.61 seconds
TestRunner_sco-tester         PASS      9.38 seconds
TestRunner_ioctl-tester       PASS      8.17 seconds
TestRunner_mesh-tester        PASS      6.04 seconds
TestRunner_smp-tester         PASS      7.09 seconds
TestRunner_userchan-tester    PASS      5.04 seconds
IncrementalBuild              PENDING   0.93 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
net/bluetooth/hci_event.c: note: in included file (through include/net/bluetooth/hci_core.h):
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
Total: 125, Passed: 121 (96.8%), Failed: 0, Not Run: 4
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 492, Passed: 487 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
LL Privacy - Start Discovery 2 (Disable RL)          Failed       0.194 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth
patchwork-bot+bluetooth@kernel.org Dec. 5, 2024, 3:50 p.m. UTC | #3 
Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed,  4 Dec 2024 11:58:48 -0500 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is
> not safe since for the most part entries fetched this way shall be
> treated as rcu_dereference:
> 
> 	Note that the value returned by rcu_dereference() is valid
> 	only within the enclosing RCU read-side critical section [1]_.
> 	For example, the following is **not** legal::
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
    https://git.kernel.org/bluetooth/bluetooth-next/c/042ca30229a0

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index aca121408369..0d59f2cfb9a4 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6872,38 +6872,27 @@  static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
 		return;
 
 	hci_dev_lock(hdev);
-	rcu_read_lock();
 
 	/* Connect all BISes that are bound to the BIG */
-	list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
-		if (bacmp(&conn->dst, BDADDR_ANY) ||
-		    conn->type != ISO_LINK ||
-		    conn->iso_qos.bcast.big != ev->handle)
+	while ((conn = hci_conn_hash_lookup_big_state(hdev, ev->handle,
+						      BT_BOUND))) {
+		if (ev->status) {
+			hci_connect_cfm(conn, ev->status);
+			hci_conn_del(conn);
 			continue;
+		}
 
 		if (hci_conn_set_handle(conn,
 					__le16_to_cpu(ev->bis_handle[i++])))
 			continue;
 
-		if (!ev->status) {
-			conn->state = BT_CONNECTED;
-			set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
-			rcu_read_unlock();
-			hci_debugfs_create_conn(conn);
-			hci_conn_add_sysfs(conn);
-			hci_iso_setup_path(conn);
-			rcu_read_lock();
-			continue;
-		}
-
-		hci_connect_cfm(conn, ev->status);
-		rcu_read_unlock();
-		hci_conn_del(conn);
-		rcu_read_lock();
+		conn->state = BT_CONNECTED;
+		set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
+		hci_debugfs_create_conn(conn);
+		hci_conn_add_sysfs(conn);
+		hci_iso_setup_path(conn);
 	}
 
-	rcu_read_unlock();
-
 	if (!ev->status && !i)
 		/* If no BISes have been connected for the BIG,
 		 * terminate. This is in case all bound connections