kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/net/bluetooth
History
Luiz Augusto von Dentz 028a68886e Bluetooth: hci_core: Fix sleeping function called from invalid context 
[ Upstream commit 4d94f05558 ]

This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs
like the bellow:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
Tested-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-01-09 13:30:04 +01:00
..
bnep Bluetooth: bnep: fix wild-memory-access in proto_unregister 2024-11-01 01:56:01 +01:00
cmtp Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2022-01-17 05:49:30 +02:00
hidp Bluetooth: Fix race condition in hidp_session_thread 2023-04-20 12:35:06 +02:00
rfcomm Bluetooth: hci_core: Fix sleeping function called from invalid context 2025-01-09 13:30:04 +01:00
6lowpan.c use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
a2mp.c use less confusing names for iov_iter direction initializers 2023-02-09 11:28:04 +01:00
a2mp.h Bluetooth: Replace zero-length array with flexible-array member 2020-02-28 08:30:02 +01:00
af_bluetooth.c Revert "Bluetooth: af_bluetooth: Fix deadlock" 2024-11-17 15:07:19 +01:00
amp.c Bluetooth: amp: Use the correct print format 2021-06-26 07:12:41 +02:00
amp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284 2019-06-05 17:36:37 +02:00
aosp.c Bluetooth: Fix null pointer deref on unexpected status event 2022-08-08 17:04:37 -07:00
aosp.h Bluetooth: aosp: Support AOSP Bluetooth Quality Report 2021-11-02 19:37:52 +01:00
ecdh_helper.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
ecdh_helper.h Fix misc new gcc warnings 2021-04-27 17:05:53 -07:00
eir.c Bluetooth: Fix eir name length 2024-03-26 18:20:42 -04:00
eir.h Bluetooth: Add initial implementation of BIS connections 2022-07-22 17:13:56 -07:00
hci_codec.c Bluetooth: Fix support for Read Local Supported Codecs V2 2022-12-02 13:09:31 -08:00
hci_codec.h Bluetooth: Add support for Read Local Supported Codecs V2 2021-09-07 14:09:18 -07:00
hci_conn.c Revert "Bluetooth: hci_conn: Consolidate code for aborting connections" 2024-11-17 15:07:19 +01:00
hci_core.c Bluetooth: hci_core: Fix sleeping function called from invalid context 2025-01-09 13:30:04 +01:00
hci_debugfs.c Bluetooth: Fix TOCTOU in HCI debugfs implementation 2024-04-10 16:28:24 +02:00
hci_debugfs.h Bluetooth: hci_core: Move all debugfs handling to hci_debugfs.c 2021-09-22 16:17:13 +02:00
hci_event.c Bluetooth: hci_event: Remove code to removed CONFIG_BT_HS 2024-11-22 15:37:29 +01:00
hci_request.c Bluetooth: Fix memory leak in hci_req_sync_complete() 2024-04-17 11:18:22 +02:00
hci_request.h Bluetooth: Delete unused hci_req_prepare_suspend() declaration 2023-10-10 22:00:40 +02:00
hci_sock.c Bluetooth: hci_sock: Fix not validating setsockopt user input 2024-10-17 15:21:33 +02:00
hci_sync.c Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue 2024-12-14 19:53:12 +01:00
hci_sysfs.c Bluetooth: fix use-after-free in device_for_each_child() 2024-12-14 19:53:34 +01:00
iso.c Bluetooth: hci_core: Fix sleeping function called from invalid context 2025-01-09 13:30:04 +01:00
Kconfig Bluetooth: Add initial implementation of CIS connections 2022-07-22 17:13:22 -07:00
l2cap_core.c Bluetooth: hci_core: Fix sleeping function called from invalid context 2025-01-09 13:30:04 +01:00
l2cap_sock.c Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() 2024-12-14 19:54:41 +01:00
leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
leds.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
lib.c Bluetooth: Fix EALREADY and ELOOP cases in bt_status() 2022-12-31 13:32:28 +01:00
Makefile Bluetooth: Add BTPROTO_ISO socket type 2022-07-22 17:13:39 -07:00
mgmt.c Bluetooth: MGMT: Fix possible deadlocks 2024-12-14 19:54:56 +01:00
mgmt_config.c Bluetooth: mgmt: Use the correct print format 2021-06-26 07:12:42 +02:00
mgmt_config.h Bluetooth: mgmt: Add commands for runtime configuration 2020-06-18 13:11:03 +03:00
mgmt_util.c Bluetooth: Implement support for Mesh 2022-09-06 13:18:24 -07:00
mgmt_util.h Bluetooth: Fix a buffer overflow in mgmt_mesh_add() 2023-02-01 08:34:21 +01:00
msft.c Bluetooth: msft: fix slab-use-after-free in msft_do_close() 2024-05-17 11:56:11 +02:00
msft.h Bluetooth: msft: fix slab-use-after-free in msft_do_close() 2024-05-17 11:56:11 +02:00
sco.c Bluetooth: hci_core: Fix sleeping function called from invalid context 2025-01-09 13:30:04 +01:00
selftest.c crypto: ecdh - move curve_id of ECDH from the key to algorithm name 2021-03-13 00:04:03 +11:00
selftest.h Bluetooth: Add support for self testing framework 2014-12-30 08:53:55 +02:00
smp.c Revert "Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE" 2024-09-12 11:10:17 +02:00
smp.h Bluetooth: use inclusive language in SMP 2021-06-26 07:12:37 +02:00