All of lore.kernel.org
 help / color / mirror / Atom feed
* [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt
@ 2024-04-07 11:33 syzbot
  2024-04-07 12:16 ` Hillf Danton
                   ` (4 more replies)
  0 siblings, 5 replies; 10+ messages in thread
From: syzbot @ 2024-04-07 11:33 UTC (permalink / raw)
  To: johan.hedberg, linux-bluetooth, linux-kernel, luiz.dentz, marcel,
	syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    480e035fc4c7 Merge tag 'drm-next-2024-03-13' of https://gi..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=12154da9180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1e5b814e91787669
dashboard link: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14136223180000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11ee2e75180000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5f73b6ef963d/disk-480e035f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/46c949396aad/vmlinux-480e035f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e3b4d0f5a5f8/bzImage-480e035f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

=============================
[ BUG: Invalid wait context ]
6.8.0-syzkaller-08073-g480e035fc4c7 #0 Tainted: G        W         
-----------------------------
kworker/u9:2/5070 is trying to lock:
ffffffff8f4f5aa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
ffffffff8f4f5aa8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
other info that might help us debug this:
context-{4:4}
4 locks held by kworker/u9:2/5070:
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
stack backtrace:
CPU: 0 PID: 5070 Comm: kworker/u9:2 Tainted: G        W          6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4751 [inline]
 check_wait_context kernel/locking/lockdep.c:4821 [inline]
 __lock_acquire+0x1507/0x1fd0 kernel/locking/lockdep.c:5087
 lock_acquire+0x1e4/0x530 kernel/locking/lockdep.c:5754
 __mutex_lock_common kernel/locking/mutex.c:608 [inline]
 __mutex_lock+0x136/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>
==================================================================
BUG: KASAN: slab-use-after-free in hci_le_create_big_complete_evt+0x383/0xae0
Read of size 8 at addr ffff88807cb1c000 by task kworker/u9:2/5070

CPU: 0 PID: 5070 Comm: kworker/u9:2 Tainted: G        W          6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 hci_le_create_big_complete_evt+0x383/0xae0
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Allocated by task 5070:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 kmalloc_trace+0x1db/0x360 mm/slub.c:3997
 kmalloc include/linux/slab.h:628 [inline]
 kzalloc include/linux/slab.h:749 [inline]
 hci_conn_add+0xc7/0x13a0 net/bluetooth/hci_conn.c:914
 hci_le_big_sync_established_evt+0x1cf/0xb90 net/bluetooth/hci_event.c:6980
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

Freed by task 5070:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240
 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2106 [inline]
 slab_free mm/slub.c:4280 [inline]
 kfree+0x14a/0x380 mm/slub.c:4390
 device_release+0x99/0x1c0
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x22f/0x480 lib/kobject.c:737
 hci_conn_cleanup net/bluetooth/hci_conn.c:176 [inline]
 hci_conn_del+0x900/0xc80 net/bluetooth/hci_conn.c:1126
 hci_le_create_big_complete_evt+0x619/0xae0 net/bluetooth/hci_event.c:6941
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

The buggy address belongs to the object at ffff88807cb1c000
 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 0 bytes inside of
 freed 8192-byte region [ffff88807cb1c000, ffff88807cb1e000)

The buggy address belongs to the physical page:
page:ffffea0001f2c600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7cb18
head:ffffea0001f2c600 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c42280 ffffea0001f2cc00 dead000000000003
raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4524, tgid 4524 (S10udev), ts 19996984719, free_ts 17455903844
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page+0x5f/0x160 mm/slub.c:2175
 allocate_slab mm/slub.c:2338 [inline]
 new_slab+0x84/0x2f0 mm/slub.c:2391
 ___slab_alloc+0xc73/0x1260 mm/slub.c:3525
 __slab_alloc mm/slub.c:3610 [inline]
 __slab_alloc_node mm/slub.c:3663 [inline]
 slab_alloc_node mm/slub.c:3835 [inline]
 kmalloc_trace+0x269/0x360 mm/slub.c:3992
 kmalloc include/linux/slab.h:628 [inline]
 kzalloc include/linux/slab.h:749 [inline]
 tomoyo_print_bprm security/tomoyo/audit.c:26 [inline]
 tomoyo_init_log+0x11ce/0x2050 security/tomoyo/audit.c:264
 tomoyo_supervisor+0x38a/0x11f0 security/tomoyo/common.c:2089
 tomoyo_audit_env_log security/tomoyo/environ.c:36 [inline]
 tomoyo_env_perm+0x178/0x210 security/tomoyo/environ.c:63
 tomoyo_environ security/tomoyo/domain.c:672 [inline]
 tomoyo_find_next_domain+0x1384/0x1cf0 security/tomoyo/domain.c:878
 tomoyo_bprm_check_security+0x115/0x180 security/tomoyo/tomoyo.c:102
 security_bprm_check+0x65/0x90 security/security.c:1185
 search_binary_handler fs/exec.c:1765 [inline]
 exec_binprm fs/exec.c:1819 [inline]
 bprm_execve+0xa56/0x1790 fs/exec.c:1871
 do_execveat_common+0x553/0x700 fs/exec.c:1978
 do_execve fs/exec.c:2052 [inline]
 __do_sys_execve fs/exec.c:2128 [inline]
 __se_sys_execve fs/exec.c:2123 [inline]
 __x64_sys_execve+0x92/0xb0 fs/exec.c:2123
page last free pid 1 tgid 1 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346
 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
 free_contig_range+0x9e/0x160 mm/page_alloc.c:6547
 destroy_args+0x8a/0x890 mm/debug_vm_pgtable.c:1036
 debug_vm_pgtable+0x4be/0x550 mm/debug_vm_pgtable.c:1416
 do_one_initcall+0x238/0x830 init/main.c:1241
 do_initcall_level+0x157/0x210 init/main.c:1303
 do_initcalls+0x3f/0x80 init/main.c:1319
 kernel_init_freeable+0x435/0x5d0 init/main.c:1550
 kernel_init+0x1d/0x2a0 init/main.c:1439
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

Memory state around the buggy address:
 ffff88807cb1bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807cb1bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807cb1c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff88807cb1c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807cb1c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context
@ 2024-12-03 22:29 Luiz Augusto von Dentz
  2024-12-04  2:04 ` [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot
  0 siblings, 1 reply; 10+ messages in thread
From: Luiz Augusto von Dentz @ 2024-12-03 22:29 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: syzbot+2fb0835e0c9cefc34614, Luiz Augusto von Dentz

[-- Attachment #1: Type: text/plain, Size: 10242 bytes --]

#syz test

On Tue, Dec 3, 2024 at 4:15 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs
> like the bellow:
>
> BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
> in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
> preempt_count: 0, expected: 0
> RCU nest depth: 1, expected: 0
> 4 locks held by kworker/u9:2/5070:
>  #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
>  #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
>  #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
>  #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
>  #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
>  #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
>  #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
>  #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
> CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> Workqueue: hci0 hci_rx_work
> Call Trace:
>  <TASK>
>  __dump_stack lib/dump_stack.c:88 [inline]
>  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
>  __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
>  __mutex_lock_common kernel/locking/mutex.c:585 [inline]
>  __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
>  hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
>  hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
>  hci_event_func net/bluetooth/hci_event.c:7514 [inline]
>  hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
>  hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
>  process_one_work kernel/workqueue.c:3254 [inline]
>  process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
>  worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
>  kthread+0x2f0/0x390 kernel/kthread.c:388
>  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
>  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
>  </TASK>
>
> Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  include/net/bluetooth/hci_core.h | 89 ++++++++++++++++++++++----------
>  net/bluetooth/hci_core.c         |  9 ++--
>  2 files changed, 65 insertions(+), 33 deletions(-)
>
> diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> index ea798f07c5a2..95f11f04e24a 100644
> --- a/include/net/bluetooth/hci_core.h
> +++ b/include/net/bluetooth/hci_core.h
> @@ -804,7 +804,6 @@ struct hci_conn_params {
>  extern struct list_head hci_dev_list;
>  extern struct list_head hci_cb_list;
>  extern rwlock_t hci_dev_list_lock;
> -extern struct mutex hci_cb_list_lock;
>
>  #define hci_dev_set_flag(hdev, nr)             set_bit((nr), (hdev)->dev_flags)
>  #define hci_dev_clear_flag(hdev, nr)           clear_bit((nr), (hdev)->dev_flags)
> @@ -2029,12 +2028,18 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
>  {
>         struct hci_cb *cb;
>
> -       mutex_lock(&hci_cb_list_lock);
> -       list_for_each_entry(cb, &hci_cb_list, list) {
> -               if (cb->connect_cfm)
> -                       cb->connect_cfm(conn, status);
> +       rcu_read_lock();
> +       list_for_each_entry_rcu(cb, &hci_cb_list, list) {
> +               if (cb->connect_cfm) {
> +                       struct hci_cb cpy = *cb;
> +
> +                       /* Callback may block so release RCU read lock */
> +                       rcu_read_unlock();
> +                       cpy.connect_cfm(conn, status);
> +                       rcu_read_lock();
> +               }
>         }
> -       mutex_unlock(&hci_cb_list_lock);
> +       rcu_read_unlock();
>
>         if (conn->connect_cfm_cb)
>                 conn->connect_cfm_cb(conn, status);
> @@ -2044,12 +2049,18 @@ static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason)
>  {
>         struct hci_cb *cb;
>
> -       mutex_lock(&hci_cb_list_lock);
> +       rcu_read_lock();
>         list_for_each_entry(cb, &hci_cb_list, list) {
> -               if (cb->disconn_cfm)
> -                       cb->disconn_cfm(conn, reason);
> +               if (cb->disconn_cfm) {
> +                       struct hci_cb cpy = *cb;
> +
> +                       /* Callback may block so release RCU read lock */
> +                       rcu_read_unlock();
> +                       cpy.disconn_cfm(conn, reason);
> +                       rcu_read_lock();
> +               }
>         }
> -       mutex_unlock(&hci_cb_list_lock);
> +       rcu_read_unlock();
>
>         if (conn->disconn_cfm_cb)
>                 conn->disconn_cfm_cb(conn, reason);
> @@ -2065,12 +2076,18 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
>
>         encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00;
>
> -       mutex_lock(&hci_cb_list_lock);
> +       rcu_read_lock();
>         list_for_each_entry(cb, &hci_cb_list, list) {
> -               if (cb->security_cfm)
> -                       cb->security_cfm(conn, status, encrypt);
> +               if (cb->security_cfm) {
> +                       struct hci_cb cpy = *cb;
> +
> +                       /* Callback may block so release RCU read lock */
> +                       rcu_read_unlock();
> +                       cpy.security_cfm(conn, status, encrypt);
> +                       rcu_read_lock();
> +               }
>         }
> -       mutex_unlock(&hci_cb_list_lock);
> +       rcu_read_unlock();
>
>         if (conn->security_cfm_cb)
>                 conn->security_cfm_cb(conn, status);
> @@ -2105,12 +2122,18 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
>                         conn->sec_level = conn->pending_sec_level;
>         }
>
> -       mutex_lock(&hci_cb_list_lock);
> +       rcu_read_lock();
>         list_for_each_entry(cb, &hci_cb_list, list) {
> -               if (cb->security_cfm)
> -                       cb->security_cfm(conn, status, encrypt);
> +               if (cb->security_cfm) {
> +                       struct hci_cb cpy = *cb;
> +
> +                       /* Callback may block so release RCU read lock */
> +                       rcu_read_unlock();
> +                       cpy.security_cfm(conn, status, encrypt);
> +                       rcu_read_lock();
> +               }
>         }
> -       mutex_unlock(&hci_cb_list_lock);
> +       rcu_read_unlock();
>
>         if (conn->security_cfm_cb)
>                 conn->security_cfm_cb(conn, status);
> @@ -2120,12 +2143,18 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
>  {
>         struct hci_cb *cb;
>
> -       mutex_lock(&hci_cb_list_lock);
> +       rcu_read_lock();
>         list_for_each_entry(cb, &hci_cb_list, list) {
> -               if (cb->key_change_cfm)
> -                       cb->key_change_cfm(conn, status);
> +               if (cb->key_change_cfm) {
> +                       struct hci_cb cpy = *cb;
> +
> +                       /* Callback may block so release RCU read lock */
> +                       rcu_read_unlock();
> +                       cpy.key_change_cfm(conn, status);
> +                       rcu_read_lock();
> +               }
>         }
> -       mutex_unlock(&hci_cb_list_lock);
> +       rcu_read_unlock();
>  }
>
>  static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
> @@ -2133,12 +2162,18 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
>  {
>         struct hci_cb *cb;
>
> -       mutex_lock(&hci_cb_list_lock);
> -       list_for_each_entry(cb, &hci_cb_list, list) {
> -               if (cb->role_switch_cfm)
> -                       cb->role_switch_cfm(conn, status, role);
> +       rcu_read_lock();
> +       list_for_each_entry_rcu(cb, &hci_cb_list, list) {
> +               if (cb->role_switch_cfm) {
> +                       struct hci_cb cpy = *cb;
> +
> +                       /* Callback may block so release RCU read lock */
> +                       rcu_read_unlock();
> +                       cpy.role_switch_cfm(conn, status, role);
> +                       rcu_read_lock();
> +               }
>         }
> -       mutex_unlock(&hci_cb_list_lock);
> +       rcu_read_unlock();
>  }
>
>  static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index f9e19f9cb5a3..25d180d225c1 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -2993,9 +2993,7 @@ int hci_register_cb(struct hci_cb *cb)
>  {
>         BT_DBG("%p name %s", cb, cb->name);
>
> -       mutex_lock(&hci_cb_list_lock);
> -       list_add_tail(&cb->list, &hci_cb_list);
> -       mutex_unlock(&hci_cb_list_lock);
> +       list_add_tail_rcu(&cb->list, &hci_cb_list);
>
>         return 0;
>  }
> @@ -3005,9 +3003,8 @@ int hci_unregister_cb(struct hci_cb *cb)
>  {
>         BT_DBG("%p name %s", cb, cb->name);
>
> -       mutex_lock(&hci_cb_list_lock);
> -       list_del(&cb->list);
> -       mutex_unlock(&hci_cb_list_lock);
> +       list_del_rcu(&cb->list);
> +       synchronize_rcu();
>
>         return 0;
>  }
> --
> 2.47.1
>


-- 
Luiz Augusto von Dentz

[-- Attachment #2: v1-0001-Bluetooth-hci_core-Fix-sleeping-function-called-f.patch --]
[-- Type: text/x-patch, Size: 8262 bytes --]

From b5b5693a20c51d28753d1fb2e696c018ade4e61a Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Tue, 3 Dec 2024 16:07:32 -0500
Subject: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from
 invalid context

This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs
like the bellow:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 include/net/bluetooth/hci_core.h | 89 ++++++++++++++++++++++----------
 net/bluetooth/hci_core.c         |  9 ++--
 2 files changed, 65 insertions(+), 33 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ea798f07c5a2..95f11f04e24a 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -804,7 +804,6 @@ struct hci_conn_params {
 extern struct list_head hci_dev_list;
 extern struct list_head hci_cb_list;
 extern rwlock_t hci_dev_list_lock;
-extern struct mutex hci_cb_list_lock;
 
 #define hci_dev_set_flag(hdev, nr)             set_bit((nr), (hdev)->dev_flags)
 #define hci_dev_clear_flag(hdev, nr)           clear_bit((nr), (hdev)->dev_flags)
@@ -2029,12 +2028,18 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
 {
 	struct hci_cb *cb;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->connect_cfm)
-			cb->connect_cfm(conn, status);
+	rcu_read_lock();
+	list_for_each_entry_rcu(cb, &hci_cb_list, list) {
+		if (cb->connect_cfm) {
+			struct hci_cb cpy = *cb;
+
+			/* Callback may block so release RCU read lock */
+			rcu_read_unlock();
+			cpy.connect_cfm(conn, status);
+			rcu_read_lock();
+		}
 	}
-	mutex_unlock(&hci_cb_list_lock);
+	rcu_read_unlock();
 
 	if (conn->connect_cfm_cb)
 		conn->connect_cfm_cb(conn, status);
@@ -2044,12 +2049,18 @@ static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason)
 {
 	struct hci_cb *cb;
 
-	mutex_lock(&hci_cb_list_lock);
+	rcu_read_lock();
 	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->disconn_cfm)
-			cb->disconn_cfm(conn, reason);
+		if (cb->disconn_cfm) {
+			struct hci_cb cpy = *cb;
+
+			/* Callback may block so release RCU read lock */
+			rcu_read_unlock();
+			cpy.disconn_cfm(conn, reason);
+			rcu_read_lock();
+		}
 	}
-	mutex_unlock(&hci_cb_list_lock);
+	rcu_read_unlock();
 
 	if (conn->disconn_cfm_cb)
 		conn->disconn_cfm_cb(conn, reason);
@@ -2065,12 +2076,18 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 
 	encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00;
 
-	mutex_lock(&hci_cb_list_lock);
+	rcu_read_lock();
 	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->security_cfm)
-			cb->security_cfm(conn, status, encrypt);
+		if (cb->security_cfm) {
+			struct hci_cb cpy = *cb;
+
+			/* Callback may block so release RCU read lock */
+			rcu_read_unlock();
+			cpy.security_cfm(conn, status, encrypt);
+			rcu_read_lock();
+		}
 	}
-	mutex_unlock(&hci_cb_list_lock);
+	rcu_read_unlock();
 
 	if (conn->security_cfm_cb)
 		conn->security_cfm_cb(conn, status);
@@ -2105,12 +2122,18 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
 			conn->sec_level = conn->pending_sec_level;
 	}
 
-	mutex_lock(&hci_cb_list_lock);
+	rcu_read_lock();
 	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->security_cfm)
-			cb->security_cfm(conn, status, encrypt);
+		if (cb->security_cfm) {
+			struct hci_cb cpy = *cb;
+
+			/* Callback may block so release RCU read lock */
+			rcu_read_unlock();
+			cpy.security_cfm(conn, status, encrypt);
+			rcu_read_lock();
+		}
 	}
-	mutex_unlock(&hci_cb_list_lock);
+	rcu_read_unlock();
 
 	if (conn->security_cfm_cb)
 		conn->security_cfm_cb(conn, status);
@@ -2120,12 +2143,18 @@ static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 {
 	struct hci_cb *cb;
 
-	mutex_lock(&hci_cb_list_lock);
+	rcu_read_lock();
 	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->key_change_cfm)
-			cb->key_change_cfm(conn, status);
+		if (cb->key_change_cfm) {
+			struct hci_cb cpy = *cb;
+
+			/* Callback may block so release RCU read lock */
+			rcu_read_unlock();
+			cpy.key_change_cfm(conn, status);
+			rcu_read_lock();
+		}
 	}
-	mutex_unlock(&hci_cb_list_lock);
+	rcu_read_unlock();
 }
 
 static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
@@ -2133,12 +2162,18 @@ static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
 {
 	struct hci_cb *cb;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->role_switch_cfm)
-			cb->role_switch_cfm(conn, status, role);
+	rcu_read_lock();
+	list_for_each_entry_rcu(cb, &hci_cb_list, list) {
+		if (cb->role_switch_cfm) {
+			struct hci_cb cpy = *cb;
+
+			/* Callback may block so release RCU read lock */
+			rcu_read_unlock();
+			cpy.role_switch_cfm(conn, status, role);
+			rcu_read_lock();
+		}
 	}
-	mutex_unlock(&hci_cb_list_lock);
+	rcu_read_unlock();
 }
 
 static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f9e19f9cb5a3..25d180d225c1 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2993,9 +2993,7 @@ int hci_register_cb(struct hci_cb *cb)
 {
 	BT_DBG("%p name %s", cb, cb->name);
 
-	mutex_lock(&hci_cb_list_lock);
-	list_add_tail(&cb->list, &hci_cb_list);
-	mutex_unlock(&hci_cb_list_lock);
+	list_add_tail_rcu(&cb->list, &hci_cb_list);
 
 	return 0;
 }
@@ -3005,9 +3003,8 @@ int hci_unregister_cb(struct hci_cb *cb)
 {
 	BT_DBG("%p name %s", cb, cb->name);
 
-	mutex_lock(&hci_cb_list_lock);
-	list_del(&cb->list);
-	mutex_unlock(&hci_cb_list_lock);
+	list_del_rcu(&cb->list);
+	synchronize_rcu();
 
 	return 0;
 }
-- 
2.47.1


^ permalink raw reply related	[flat|nested] 10+ messages in thread
* Re: [PATCH v2] Bluetooth: hci_core: Fix sleeping function called from invalid context
@ 2024-12-05 15:12 Luiz Augusto von Dentz
  2024-12-05 15:35 ` [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot
  0 siblings, 1 reply; 10+ messages in thread
From: Luiz Augusto von Dentz @ 2024-12-05 15:12 UTC (permalink / raw)
  To: syzbot+2fb0835e0c9cefc34614; +Cc: linux-bluetooth

[-- Attachment #1: Type: text/plain, Size: 17833 bytes --]

#syz test

On Wed, Dec 4, 2024 at 1:59 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> Hi Pauli,
>
> On Wed, Dec 4, 2024 at 1:44 PM Pauli Virtanen <pav@iki.fi> wrote:
> >
> > Hi Luiz,
> >
> > ke, 2024-12-04 kello 11:58 -0500, Luiz Augusto von Dentz kirjoitti:
> > > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > >
> > > This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs
> > > like the bellow:
> >
> > This also in principle allows callbacks to be still running on another
> > CPU when hci_unregister_cb() exits. Not sure if that is unwanted.
>
> Well hci_unregister_cb is only called if you unload the whole module
> e.g bt_exit, but you can't do that if the interface is not down afaik,
> so I don't think it is possible to hit the case where the copied
> entries would be invalid due to module being unloaded.
>
> > >
> > > BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
> > > in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
> > > preempt_count: 0, expected: 0
> > > RCU nest depth: 1, expected: 0
> > > 4 locks held by kworker/u9:2/5070:
> > >  #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
> > >  #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
> > >  #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
> > >  #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
> > >  #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
> > >  #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
> > >  #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
> > >  #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
> > > CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
> > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
> > > Workqueue: hci0 hci_rx_work
> > > Call Trace:
> > >  <TASK>
> > >  __dump_stack lib/dump_stack.c:88 [inline]
> > >  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
> > >  __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
> > >  __mutex_lock_common kernel/locking/mutex.c:585 [inline]
> > >  __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
> > >  hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
> > >  hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
> > >  hci_event_func net/bluetooth/hci_event.c:7514 [inline]
> > >  hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
> > >  hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
> > >  process_one_work kernel/workqueue.c:3254 [inline]
> > >  process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
> > >  worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
> > >  kthread+0x2f0/0x390 kernel/kthread.c:388
> > >  ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
> > >  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
> > >  </TASK>
> > >
> > > Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
> > > Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
> > > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > > ---
> > >  include/net/bluetooth/hci_core.h | 108 ++++++++++++++++++++-----------
> > >  net/bluetooth/hci_core.c         |   9 +--
> > >  net/bluetooth/iso.c              |   6 ++
> > >  net/bluetooth/l2cap_core.c       |  12 ++--
> > >  net/bluetooth/rfcomm/core.c      |   6 ++
> > >  net/bluetooth/sco.c              |  12 ++--
> > >  6 files changed, 97 insertions(+), 56 deletions(-)
> > >
> > > diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> > > index ea798f07c5a2..ca22ead85dbe 100644
> > > --- a/include/net/bluetooth/hci_core.h
> > > +++ b/include/net/bluetooth/hci_core.h
> > > @@ -804,7 +804,6 @@ struct hci_conn_params {
> > >  extern struct list_head hci_dev_list;
> > >  extern struct list_head hci_cb_list;
> > >  extern rwlock_t hci_dev_list_lock;
> > > -extern struct mutex hci_cb_list_lock;
> > >
> > >  #define hci_dev_set_flag(hdev, nr)             set_bit((nr), (hdev)->dev_flags)
> > >  #define hci_dev_clear_flag(hdev, nr)           clear_bit((nr), (hdev)->dev_flags)
> > > @@ -2017,24 +2016,47 @@ struct hci_cb {
> > >
> > >       char *name;
> > >
> > > +     bool (*match)           (struct hci_conn *conn);
> > >       void (*connect_cfm)     (struct hci_conn *conn, __u8 status);
> > >       void (*disconn_cfm)     (struct hci_conn *conn, __u8 status);
> > >       void (*security_cfm)    (struct hci_conn *conn, __u8 status,
> > > -                                                             __u8 encrypt);
> > > +                              __u8 encrypt);
> > >       void (*key_change_cfm)  (struct hci_conn *conn, __u8 status);
> > >       void (*role_switch_cfm) (struct hci_conn *conn, __u8 status, __u8 role);
> > >  };
> > >
> > > +static inline void hci_cb_lookup(struct hci_conn *conn, struct list_head *list)
> > > +{
> > > +     struct hci_cb *cb, *cpy;
> > > +
> > > +     rcu_read_lock();
> > > +     list_for_each_entry_rcu(cb, &hci_cb_list, list) {
> > > +             if (cb->match && cb->match(conn)) {
> > > +                     cpy = kmalloc(sizeof(*cpy), GFP_ATOMIC);
> > > +                     if (!cpy)
> > > +                             break;
> > > +
> > > +                     *cpy = *cb;
> > > +                     INIT_LIST_HEAD(&cpy->list);
> > > +                     list_add_rcu(&cpy->list, list);
> > > +             }
> > > +     }
> > > +     rcu_read_unlock();
> > > +}
> > > +
> > >  static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
> > >  {
> > > -     struct hci_cb *cb;
> > > +     struct list_head list;
> > > +     struct hci_cb *cb, *tmp;
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_for_each_entry(cb, &hci_cb_list, list) {
> > > +     INIT_LIST_HEAD(&list);
> > > +     hci_cb_lookup(conn, &list);
> > > +
> > > +     list_for_each_entry_safe(cb, tmp, &list, list) {
> > >               if (cb->connect_cfm)
> > >                       cb->connect_cfm(conn, status);
> > > +             kfree(cb);
> > >       }
> > > -     mutex_unlock(&hci_cb_list_lock);
> > >
> > >       if (conn->connect_cfm_cb)
> > >               conn->connect_cfm_cb(conn, status);
> > > @@ -2042,22 +2064,43 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
> > >
> > >  static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason)
> > >  {
> > > -     struct hci_cb *cb;
> > > +     struct list_head list;
> > > +     struct hci_cb *cb, *tmp;
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_for_each_entry(cb, &hci_cb_list, list) {
> > > +     INIT_LIST_HEAD(&list);
> > > +     hci_cb_lookup(conn, &list);
> > > +
> > > +     list_for_each_entry_safe(cb, tmp, &list, list) {
> > >               if (cb->disconn_cfm)
> > >                       cb->disconn_cfm(conn, reason);
> > > +             kfree(cb);
> > >       }
> > > -     mutex_unlock(&hci_cb_list_lock);
> > >
> > >       if (conn->disconn_cfm_cb)
> > >               conn->disconn_cfm_cb(conn, reason);
> > >  }
> > >
> > > +static inline void hci_security_cfm(struct hci_conn *conn, __u8 status,
> > > +                                 __u8 encrypt)
> > > +{
> > > +     struct list_head list;
> > > +     struct hci_cb *cb, *tmp;
> > > +
> > > +     INIT_LIST_HEAD(&list);
> > > +     hci_cb_lookup(conn, &list);
> > > +
> > > +     list_for_each_entry_safe(cb, tmp, &list, list) {
> > > +             if (cb->security_cfm)
> > > +                     cb->security_cfm(conn, status, encrypt);
> > > +             kfree(cb);
> > > +     }
> > > +
> > > +     if (conn->security_cfm_cb)
> > > +             conn->security_cfm_cb(conn, status);
> > > +}
> > > +
> > >  static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
> > >  {
> > > -     struct hci_cb *cb;
> > >       __u8 encrypt;
> > >
> > >       if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
> > > @@ -2065,20 +2108,11 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
> > >
> > >       encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00;
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_for_each_entry(cb, &hci_cb_list, list) {
> > > -             if (cb->security_cfm)
> > > -                     cb->security_cfm(conn, status, encrypt);
> > > -     }
> > > -     mutex_unlock(&hci_cb_list_lock);
> > > -
> > > -     if (conn->security_cfm_cb)
> > > -             conn->security_cfm_cb(conn, status);
> > > +     hci_security_cfm(conn, status, encrypt);
> > >  }
> > >
> > >  static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
> > >  {
> > > -     struct hci_cb *cb;
> > >       __u8 encrypt;
> > >
> > >       if (conn->state == BT_CONFIG) {
> > > @@ -2105,40 +2139,38 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
> > >                       conn->sec_level = conn->pending_sec_level;
> > >       }
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_for_each_entry(cb, &hci_cb_list, list) {
> > > -             if (cb->security_cfm)
> > > -                     cb->security_cfm(conn, status, encrypt);
> > > -     }
> > > -     mutex_unlock(&hci_cb_list_lock);
> > > -
> > > -     if (conn->security_cfm_cb)
> > > -             conn->security_cfm_cb(conn, status);
> > > +     hci_security_cfm(conn, status, encrypt);
> > >  }
> > >
> > >  static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
> > >  {
> > > -     struct hci_cb *cb;
> > > +     struct list_head list;
> > > +     struct hci_cb *cb, *tmp;
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_for_each_entry(cb, &hci_cb_list, list) {
> > > +     INIT_LIST_HEAD(&list);
> > > +     hci_cb_lookup(conn, &list);
> > > +
> > > +     list_for_each_entry_safe(cb, tmp, &list, list) {
> > >               if (cb->key_change_cfm)
> > >                       cb->key_change_cfm(conn, status);
> > > +             kfree(cb);
> > >       }
> > > -     mutex_unlock(&hci_cb_list_lock);
> > >  }
> > >
> > >  static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
> > >                                                               __u8 role)
> > >  {
> > > -     struct hci_cb *cb;
> > > +     struct list_head list;
> > > +     struct hci_cb *cb, *tmp;
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_for_each_entry(cb, &hci_cb_list, list) {
> > > +     INIT_LIST_HEAD(&list);
> > > +     hci_cb_lookup(conn, &list);
> > > +
> > > +     list_for_each_entry_safe(cb, tmp, &list, list) {
> > >               if (cb->role_switch_cfm)
> > >                       cb->role_switch_cfm(conn, status, role);
> > > +             kfree(cb);
> > >       }
> > > -     mutex_unlock(&hci_cb_list_lock);
> > >  }
> > >
> > >  static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)
> > > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > > index f9e19f9cb5a3..25d180d225c1 100644
> > > --- a/net/bluetooth/hci_core.c
> > > +++ b/net/bluetooth/hci_core.c
> > > @@ -2993,9 +2993,7 @@ int hci_register_cb(struct hci_cb *cb)
> > >  {
> > >       BT_DBG("%p name %s", cb, cb->name);
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_add_tail(&cb->list, &hci_cb_list);
> > > -     mutex_unlock(&hci_cb_list_lock);
> > > +     list_add_tail_rcu(&cb->list, &hci_cb_list);
> > >
> > >       return 0;
> > >  }
> > > @@ -3005,9 +3003,8 @@ int hci_unregister_cb(struct hci_cb *cb)
> > >  {
> > >       BT_DBG("%p name %s", cb, cb->name);
> > >
> > > -     mutex_lock(&hci_cb_list_lock);
> > > -     list_del(&cb->list);
> > > -     mutex_unlock(&hci_cb_list_lock);
> > > +     list_del_rcu(&cb->list);
> > > +     synchronize_rcu();
> > >
> > >       return 0;
> > >  }
> > > diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> > > index 8ed818254dc8..eccdaa16cba0 100644
> > > --- a/net/bluetooth/iso.c
> > > +++ b/net/bluetooth/iso.c
> > > @@ -2154,6 +2154,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
> > >       return HCI_LM_ACCEPT;
> > >  }
> > >
> > > +static bool iso_match(struct hci_conn *hcon)
> > > +{
> > > +     return hcon->type == ISO_LINK || hcon->type == LE_LINK;
> > > +}
> > > +
> > >  static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)
> > >  {
> > >       if (hcon->type != ISO_LINK) {
> > > @@ -2335,6 +2340,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > >
> > >  static struct hci_cb iso_cb = {
> > >       .name           = "ISO",
> > > +     .match          = iso_match,
> > >       .connect_cfm    = iso_connect_cfm,
> > >       .disconn_cfm    = iso_disconn_cfm,
> > >  };
> > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> > > index 6544c1ed7143..27b4c4a2ba1f 100644
> > > --- a/net/bluetooth/l2cap_core.c
> > > +++ b/net/bluetooth/l2cap_core.c
> > > @@ -7217,6 +7217,11 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
> > >       return NULL;
> > >  }
> > >
> > > +static bool l2cap_match(struct hci_conn *hcon)
> > > +{
> > > +     return hcon->type == ACL_LINK || hcon->type == LE_LINK;
> > > +}
> > > +
> > >  static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
> > >  {
> > >       struct hci_dev *hdev = hcon->hdev;
> > > @@ -7224,9 +7229,6 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
> > >       struct l2cap_chan *pchan;
> > >       u8 dst_type;
> > >
> > > -     if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
> > > -             return;
> > > -
> > >       BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
> > >
> > >       if (status) {
> > > @@ -7291,9 +7293,6 @@ int l2cap_disconn_ind(struct hci_conn *hcon)
> > >
> > >  static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
> > >  {
> > > -     if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
> > > -             return;
> > > -
> > >       BT_DBG("hcon %p reason %d", hcon, reason);
> > >
> > >       l2cap_conn_del(hcon, bt_to_errno(reason));
> > > @@ -7572,6 +7571,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
> > >
> > >  static struct hci_cb l2cap_cb = {
> > >       .name           = "L2CAP",
> > > +     .match          = l2cap_match,
> > >       .connect_cfm    = l2cap_connect_cfm,
> > >       .disconn_cfm    = l2cap_disconn_cfm,
> > >       .security_cfm   = l2cap_security_cfm,
> > > diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
> > > index ad5177e3a69b..4c56ca5a216c 100644
> > > --- a/net/bluetooth/rfcomm/core.c
> > > +++ b/net/bluetooth/rfcomm/core.c
> > > @@ -2134,6 +2134,11 @@ static int rfcomm_run(void *unused)
> > >       return 0;
> > >  }
> > >
> > > +static bool rfcomm_match(struct hci_conn *hcon)
> > > +{
> > > +     return hcon->type == ACL_LINK;
> > > +}
> > > +
> > >  static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
> > >  {
> > >       struct rfcomm_session *s;
> > > @@ -2180,6 +2185,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
> > >
> > >  static struct hci_cb rfcomm_cb = {
> > >       .name           = "RFCOMM",
> > > +     .match          = rfcomm_match,
> > >       .security_cfm   = rfcomm_security_cfm
> > >  };
> > >
> > > diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
> > > index 7eb8d3e04ec4..40c4957cfc0b 100644
> > > --- a/net/bluetooth/sco.c
> > > +++ b/net/bluetooth/sco.c
> > > @@ -1397,11 +1397,13 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
> > >       return lm;
> > >  }
> > >
> > > +static bool sco_match(struct hci_conn *hcon)
> > > +{
> > > +     return hcon->type == SCO_LINK || hcon->type == ESCO_LINK;
> > > +}
> > > +
> > >  static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
> > >  {
> > > -     if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
> > > -             return;
> > > -
> > >       BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
> > >
> > >       if (!status) {
> > > @@ -1416,9 +1418,6 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
> > >
> > >  static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
> > >  {
> > > -     if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
> > > -             return;
> > > -
> > >       BT_DBG("hcon %p reason %d", hcon, reason);
> > >
> > >       sco_conn_del(hcon, bt_to_errno(reason));
> > > @@ -1444,6 +1443,7 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
> > >
> > >  static struct hci_cb sco_cb = {
> > >       .name           = "SCO",
> > > +     .match          = sco_match,
> > >       .connect_cfm    = sco_connect_cfm,
> > >       .disconn_cfm    = sco_disconn_cfm,
> > >  };
> >
>
>
> --
> Luiz Augusto von Dentz



-- 
Luiz Augusto von Dentz

[-- Attachment #2: v2-0001-Bluetooth-hci_core-Fix-sleeping-function-called-f.patch --]
[-- Type: text/x-patch, Size: 13195 bytes --]

From d984fcb83178e73b99519d4e2ccbefbbcacb57b2 Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Tue, 3 Dec 2024 16:07:32 -0500
Subject: [PATCH v2] Bluetooth: hci_core: Fix sleeping function called from
 invalid context

This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs
like the bellow:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 include/net/bluetooth/hci_core.h | 108 ++++++++++++++++++++-----------
 net/bluetooth/hci_core.c         |   9 +--
 net/bluetooth/iso.c              |   6 ++
 net/bluetooth/l2cap_core.c       |  12 ++--
 net/bluetooth/rfcomm/core.c      |   6 ++
 net/bluetooth/sco.c              |  12 ++--
 6 files changed, 97 insertions(+), 56 deletions(-)

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index ea798f07c5a2..ca22ead85dbe 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -804,7 +804,6 @@ struct hci_conn_params {
 extern struct list_head hci_dev_list;
 extern struct list_head hci_cb_list;
 extern rwlock_t hci_dev_list_lock;
-extern struct mutex hci_cb_list_lock;
 
 #define hci_dev_set_flag(hdev, nr)             set_bit((nr), (hdev)->dev_flags)
 #define hci_dev_clear_flag(hdev, nr)           clear_bit((nr), (hdev)->dev_flags)
@@ -2017,24 +2016,47 @@ struct hci_cb {
 
 	char *name;
 
+	bool (*match)		(struct hci_conn *conn);
 	void (*connect_cfm)	(struct hci_conn *conn, __u8 status);
 	void (*disconn_cfm)	(struct hci_conn *conn, __u8 status);
 	void (*security_cfm)	(struct hci_conn *conn, __u8 status,
-								__u8 encrypt);
+				 __u8 encrypt);
 	void (*key_change_cfm)	(struct hci_conn *conn, __u8 status);
 	void (*role_switch_cfm)	(struct hci_conn *conn, __u8 status, __u8 role);
 };
 
+static inline void hci_cb_lookup(struct hci_conn *conn, struct list_head *list)
+{
+	struct hci_cb *cb, *cpy;
+
+	rcu_read_lock();
+	list_for_each_entry_rcu(cb, &hci_cb_list, list) {
+		if (cb->match && cb->match(conn)) {
+			cpy = kmalloc(sizeof(*cpy), GFP_ATOMIC);
+			if (!cpy)
+				break;
+
+			*cpy = *cb;
+			INIT_LIST_HEAD(&cpy->list);
+			list_add_rcu(&cpy->list, list);
+		}
+	}
+	rcu_read_unlock();
+}
+
 static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
 {
-	struct hci_cb *cb;
+	struct list_head list;
+	struct hci_cb *cb, *tmp;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
+	INIT_LIST_HEAD(&list);
+	hci_cb_lookup(conn, &list);
+
+	list_for_each_entry_safe(cb, tmp, &list, list) {
 		if (cb->connect_cfm)
 			cb->connect_cfm(conn, status);
+		kfree(cb);
 	}
-	mutex_unlock(&hci_cb_list_lock);
 
 	if (conn->connect_cfm_cb)
 		conn->connect_cfm_cb(conn, status);
@@ -2042,22 +2064,43 @@ static inline void hci_connect_cfm(struct hci_conn *conn, __u8 status)
 
 static inline void hci_disconn_cfm(struct hci_conn *conn, __u8 reason)
 {
-	struct hci_cb *cb;
+	struct list_head list;
+	struct hci_cb *cb, *tmp;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
+	INIT_LIST_HEAD(&list);
+	hci_cb_lookup(conn, &list);
+
+	list_for_each_entry_safe(cb, tmp, &list, list) {
 		if (cb->disconn_cfm)
 			cb->disconn_cfm(conn, reason);
+		kfree(cb);
 	}
-	mutex_unlock(&hci_cb_list_lock);
 
 	if (conn->disconn_cfm_cb)
 		conn->disconn_cfm_cb(conn, reason);
 }
 
+static inline void hci_security_cfm(struct hci_conn *conn, __u8 status,
+				    __u8 encrypt)
+{
+	struct list_head list;
+	struct hci_cb *cb, *tmp;
+
+	INIT_LIST_HEAD(&list);
+	hci_cb_lookup(conn, &list);
+
+	list_for_each_entry_safe(cb, tmp, &list, list) {
+		if (cb->security_cfm)
+			cb->security_cfm(conn, status, encrypt);
+		kfree(cb);
+	}
+
+	if (conn->security_cfm_cb)
+		conn->security_cfm_cb(conn, status);
+}
+
 static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 {
-	struct hci_cb *cb;
 	__u8 encrypt;
 
 	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
@@ -2065,20 +2108,11 @@ static inline void hci_auth_cfm(struct hci_conn *conn, __u8 status)
 
 	encrypt = test_bit(HCI_CONN_ENCRYPT, &conn->flags) ? 0x01 : 0x00;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->security_cfm)
-			cb->security_cfm(conn, status, encrypt);
-	}
-	mutex_unlock(&hci_cb_list_lock);
-
-	if (conn->security_cfm_cb)
-		conn->security_cfm_cb(conn, status);
+	hci_security_cfm(conn, status, encrypt);
 }
 
 static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
 {
-	struct hci_cb *cb;
 	__u8 encrypt;
 
 	if (conn->state == BT_CONFIG) {
@@ -2105,40 +2139,38 @@ static inline void hci_encrypt_cfm(struct hci_conn *conn, __u8 status)
 			conn->sec_level = conn->pending_sec_level;
 	}
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
-		if (cb->security_cfm)
-			cb->security_cfm(conn, status, encrypt);
-	}
-	mutex_unlock(&hci_cb_list_lock);
-
-	if (conn->security_cfm_cb)
-		conn->security_cfm_cb(conn, status);
+	hci_security_cfm(conn, status, encrypt);
 }
 
 static inline void hci_key_change_cfm(struct hci_conn *conn, __u8 status)
 {
-	struct hci_cb *cb;
+	struct list_head list;
+	struct hci_cb *cb, *tmp;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
+	INIT_LIST_HEAD(&list);
+	hci_cb_lookup(conn, &list);
+
+	list_for_each_entry_safe(cb, tmp, &list, list) {
 		if (cb->key_change_cfm)
 			cb->key_change_cfm(conn, status);
+		kfree(cb);
 	}
-	mutex_unlock(&hci_cb_list_lock);
 }
 
 static inline void hci_role_switch_cfm(struct hci_conn *conn, __u8 status,
 								__u8 role)
 {
-	struct hci_cb *cb;
+	struct list_head list;
+	struct hci_cb *cb, *tmp;
 
-	mutex_lock(&hci_cb_list_lock);
-	list_for_each_entry(cb, &hci_cb_list, list) {
+	INIT_LIST_HEAD(&list);
+	hci_cb_lookup(conn, &list);
+
+	list_for_each_entry_safe(cb, tmp, &list, list) {
 		if (cb->role_switch_cfm)
 			cb->role_switch_cfm(conn, status, role);
+		kfree(cb);
 	}
-	mutex_unlock(&hci_cb_list_lock);
 }
 
 static inline bool hci_bdaddr_is_rpa(bdaddr_t *bdaddr, u8 addr_type)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index f9e19f9cb5a3..25d180d225c1 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2993,9 +2993,7 @@ int hci_register_cb(struct hci_cb *cb)
 {
 	BT_DBG("%p name %s", cb, cb->name);
 
-	mutex_lock(&hci_cb_list_lock);
-	list_add_tail(&cb->list, &hci_cb_list);
-	mutex_unlock(&hci_cb_list_lock);
+	list_add_tail_rcu(&cb->list, &hci_cb_list);
 
 	return 0;
 }
@@ -3005,9 +3003,8 @@ int hci_unregister_cb(struct hci_cb *cb)
 {
 	BT_DBG("%p name %s", cb, cb->name);
 
-	mutex_lock(&hci_cb_list_lock);
-	list_del(&cb->list);
-	mutex_unlock(&hci_cb_list_lock);
+	list_del_rcu(&cb->list);
+	synchronize_rcu();
 
 	return 0;
 }
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 8ed818254dc8..eccdaa16cba0 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2154,6 +2154,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
 	return HCI_LM_ACCEPT;
 }
 
+static bool iso_match(struct hci_conn *hcon)
+{
+	return hcon->type == ISO_LINK || hcon->type == LE_LINK;
+}
+
 static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)
 {
 	if (hcon->type != ISO_LINK) {
@@ -2335,6 +2340,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 
 static struct hci_cb iso_cb = {
 	.name		= "ISO",
+	.match		= iso_match,
 	.connect_cfm	= iso_connect_cfm,
 	.disconn_cfm	= iso_disconn_cfm,
 };
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 6544c1ed7143..27b4c4a2ba1f 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7217,6 +7217,11 @@ static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
 	return NULL;
 }
 
+static bool l2cap_match(struct hci_conn *hcon)
+{
+	return hcon->type == ACL_LINK || hcon->type == LE_LINK;
+}
+
 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
 {
 	struct hci_dev *hdev = hcon->hdev;
@@ -7224,9 +7229,6 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
 	struct l2cap_chan *pchan;
 	u8 dst_type;
 
-	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
-		return;
-
 	BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
 
 	if (status) {
@@ -7291,9 +7293,6 @@ int l2cap_disconn_ind(struct hci_conn *hcon)
 
 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
 {
-	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
-		return;
-
 	BT_DBG("hcon %p reason %d", hcon, reason);
 
 	l2cap_conn_del(hcon, bt_to_errno(reason));
@@ -7572,6 +7571,7 @@ void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 
 static struct hci_cb l2cap_cb = {
 	.name		= "L2CAP",
+	.match		= l2cap_match,
 	.connect_cfm	= l2cap_connect_cfm,
 	.disconn_cfm	= l2cap_disconn_cfm,
 	.security_cfm	= l2cap_security_cfm,
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index ad5177e3a69b..4c56ca5a216c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2134,6 +2134,11 @@ static int rfcomm_run(void *unused)
 	return 0;
 }
 
+static bool rfcomm_match(struct hci_conn *hcon)
+{
+	return hcon->type == ACL_LINK;
+}
+
 static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 {
 	struct rfcomm_session *s;
@@ -2180,6 +2185,7 @@ static void rfcomm_security_cfm(struct hci_conn *conn, u8 status, u8 encrypt)
 
 static struct hci_cb rfcomm_cb = {
 	.name		= "RFCOMM",
+	.match		= rfcomm_match,
 	.security_cfm	= rfcomm_security_cfm
 };
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 7eb8d3e04ec4..40c4957cfc0b 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1397,11 +1397,13 @@ int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
 	return lm;
 }
 
+static bool sco_match(struct hci_conn *hcon)
+{
+	return hcon->type == SCO_LINK || hcon->type == ESCO_LINK;
+}
+
 static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
 {
-	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-		return;
-
 	BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
 
 	if (!status) {
@@ -1416,9 +1418,6 @@ static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
 
 static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
 {
-	if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
-		return;
-
 	BT_DBG("hcon %p reason %d", hcon, reason);
 
 	sco_conn_del(hcon, bt_to_errno(reason));
@@ -1444,6 +1443,7 @@ void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
 
 static struct hci_cb sco_cb = {
 	.name		= "SCO",
+	.match		= sco_match,
 	.connect_cfm	= sco_connect_cfm,
 	.disconn_cfm	= sco_disconn_cfm,
 };
-- 
2.47.1


^ permalink raw reply related	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2024-12-05 15:35 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-07 11:33 [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot
2024-04-07 12:16 ` Hillf Danton
2024-04-07 12:50   ` syzbot
2024-04-07 13:59 ` syzbot
2024-04-07 23:14 ` Hillf Danton
2024-04-08  1:50   ` syzbot
2024-12-03 22:30 ` [syzbot] Re: [PATCH v1] Bluetooth: hci_core: Fix sleeping function called from invalid context syzbot
2024-12-05 15:13 ` [syzbot] Re: [PATCH v2] " syzbot
  -- strict thread matches above, loose matches on Subject: below --
2024-12-03 22:29 [PATCH v1] " Luiz Augusto von Dentz
2024-12-04  2:04 ` [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot
2024-12-05 15:12 [PATCH v2] Bluetooth: hci_core: Fix sleeping function called from invalid context Luiz Augusto von Dentz
2024-12-05 15:35 ` [syzbot] [bluetooth?] BUG: sleeping function called from invalid context in hci_le_create_big_complete_evt syzbot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.