Re: [PATCH 2/2 v2] bluetooth: hci_core: fix NULL-pointer dereference at unregister

From: David Herrmann <hidden>
Date: 2012-03-09 14:04:16
Also in: linux-bluetooth, lkml, netdev

Hi Johan

On Fri, Mar 9, 2012 at 1:53 PM, Johan Hovold [off-list ref] wrote:

quoted hunk ↗ jump to hunk

Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.

This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.

Bug is 100% reproducible using hciattach and a disconnected serial port:

0. # hciattach -n /dev/ttyO1 any noflow

1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
ï¿½ eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
ï¿½ hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...

[ ï¿½ 79.627136] INFO: trying to register non-static key.
[ ï¿½ 79.632354] the code is fine but needs lockdep annotation.
[ ï¿½ 79.638122] turning off the locking correctness validator.
[ ï¿½ 79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0)
[ ï¿½ 79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128)
[ ï¿½ 79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac)
[ ï¿½ 79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[ ï¿½ 79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[ ï¿½ 79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[ ï¿½ 79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[ ï¿½ 79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[ ï¿½ 79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[ ï¿½ 79.723358] 1fa0: ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ 0001e6a0 be8dab00 0001e698 00036698
[ ï¿½ 79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ ï¿½ 79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[ ï¿½ 79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ ï¿½ 79.756011] pgd = cf3b4000
[ ï¿½ 79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[ ï¿½ 79.765502] Internal error: Oops: 80000007 [#1]
[ ï¿½ 79.770294] Modules linked in:
[ ï¿½ 79.773529] CPU: 0 ï¿½ ï¿½Tainted: G ï¿½ ï¿½ ï¿½ ï¿½W ï¿½ ï¿½ (3.3.0-rc6-00002-gb5d5c87 #421)
[ ï¿½ 79.781066] PC is at 0x0
[ ï¿½ 79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[ ï¿½ 79.788787] pc : [<00000000>] ï¿½ ï¿½lr : [<c0040aa4>] ï¿½ ï¿½psr: 60000113
[ ï¿½ 79.788787] sp : cf281ee0 ï¿½ip : 00000000 ï¿½fp : cf280000
[ ï¿½ 79.800903] r10: 00000004 ï¿½r9 : 00000100 ï¿½r8 : b6f234d0
[ ï¿½ 79.806427] r7 : c0519c28 ï¿½r6 : cf093488 ï¿½r5 : c0561a00 ï¿½r4 : 00000000
[ ï¿½ 79.813323] r3 : 00000000 ï¿½r2 : c054eee0 ï¿½r1 : 00000001 ï¿½r0 : 00000000
[ ï¿½ 79.820190] Flags: nZCv ï¿½IRQs on ï¿½FIQs on ï¿½Mode SVC_32 ï¿½ISA ARM ï¿½Segment user
[ ï¿½ 79.827728] Control: 10c5387d ï¿½Table: 8f3b4019 ï¿½DAC: 00000015
[ ï¿½ 79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[ ï¿½ 79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[ ï¿½ 79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[ ï¿½ 79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[ ï¿½ 79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[ ï¿½ 79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[ ï¿½ 79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[ ï¿½ 79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[ ï¿½ 79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[ ï¿½ 79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ ï¿½ 79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[ ï¿½ 79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[ ï¿½ 79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[ ï¿½ 79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[ ï¿½ 79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[ ï¿½ 79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[ ï¿½ 79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[ ï¿½ 79.973083] 1fa0: ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ 0001e6a0 be8dab00 0001e698 00036698
[ ï¿½ 79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ ï¿½ 79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[ ï¿½ 79.997161] Code: bad PC value
[ ï¿½ 80.000396] ---[ end trace 6f6739840475f9ee ]---
[ ï¿½ 80.005279] Kernel panic - not syncing: Fatal exception in interrupt

Cc: stable <redacted>
Signed-off-by: Johan Hovold <redacted>
---

v2: use hdev->dev_flags for internal unregister flag


ï¿½include/net/bluetooth/hci.h | ï¿½ ï¿½2 ++
ï¿½net/bluetooth/hci_core.c ï¿½ ï¿½| ï¿½ ï¿½7 +++++++
ï¿½2 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h
index 00596e8..e8879b9 100644
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h

@@ -93,6 +93,8 @@ enum {

ï¿½* states from the controller.
ï¿½*/
ï¿½enum {
+ ï¿½ ï¿½ ï¿½ HCI_UNREGISTER,
+
ï¿½ ï¿½ ï¿½ ï¿½HCI_LE_SCAN,
ï¿½};

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d6448f0..22b6781 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c

@@ -525,6 +525,11 @@ int hci_dev_open(__u16 dev)

ï¿½ ï¿½ ï¿½ ï¿½hci_req_lock(hdev);

+ ï¿½ ï¿½ ï¿½ if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
+ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ret = -ENODEV;
+ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ goto done;
+ ï¿½ ï¿½ ï¿½ }
+

Isn't it enough to check for HCI_RUNNING here? We obviously have a
race here as we take the device with hci_dev_get(), then sleep and
then we do not check whether the device is still alive. However,
drivers are required to reset HCI_RUNNING before calling
hci_unregister_dev() (which is bogus anyway, but its the way we
handled it in the past) therefore it should be enough for us to check
for HCI_RUNNING.

Regards
David

quoted hunk ↗ jump to hunk

ï¿½ ï¿½ ï¿½ ï¿½if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ret = -ERFKILL;
ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½ ï¿½goto done;

@@ -1577,6 +1582,8 @@ void hci_unregister_dev(struct hci_dev *hdev)

ï¿½ ï¿½ ï¿½ ï¿½BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

+ ï¿½ ï¿½ ï¿½ set_bit(HCI_UNREGISTER, &hdev->dev_flags);
+
ï¿½ ï¿½ ï¿½ ï¿½write_lock(&hci_dev_list_lock);
ï¿½ ï¿½ ï¿½ ï¿½list_del(&hdev->list);
ï¿½ ï¿½ ï¿½ ï¿½write_unlock(&hci_dev_list_lock);
--
1.7.8.4

--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at ï¿½http://vger.kernel.org/majordomo-info.html

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help