[PATCH] Bluetooth: RFCOMM: possible deadlock in rfcomm_dlc_exists

[PATCH] Bluetooth: RFCOMM: possible deadlock in rfcomm_dlc_exists

[Alexander Ofitserov]

This bug was found by syzkaller.
This bug is also very similar to another RFCOMM possible deadlock
in rfcomm_dlc_exists. Both of these bugs are present in syzbot.
Patch fixes two of these possible dedlock errors.
Also this particular patch was already written in march of 2023
by Hillf Danton, but seems like it just got lost or forgotten.
Links to these bugs and original patch on syzbot:
Link: https://syzkaller.appspot.com/bug?extid=b69a625d06e8ece26415
Link: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
Link: https://syzkaller.appspot.com/text?tag=Patch&x=133a6835c80000

Signed-off-by: Alexander Ofitserov <oficerovas@altlinux.org>
---
 net/bluetooth/rfcomm/core.c |  2 +-
 net/bluetooth/rfcomm/sock.c |  2 --
 net/bluetooth/rfcomm/tty.c  | 11 +++++++----
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 1d34d849703329..d8502914e3602c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -490,8 +490,8 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 
 		rfcomm_dlc_lock(d);
 		d->state = BT_CLOSED;
-		d->state_change(d, err);
 		rfcomm_dlc_unlock(d);
+		d->state_change(d, err);
 
 		skb_queue_purge(&d->tx_queue);
 		rfcomm_dlc_unlink(d);
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 29aa07e9db9d71..cbff37b3273407 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
 
 	if (err == -ENOIOCTLCMD) {
 #ifdef CONFIG_BT_RFCOMM_TTY
-		lock_sock(sk);
 		err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
-		release_sock(sk);
 #else
 		err = -EOPNOTSUPP;
 #endif
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 69c75c041fe10a..5be21b987141fc 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -403,9 +403,12 @@ static int __rfcomm_create_dev(struct sock *sk, void __user *arg)
 		return -EPERM;
 
 	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
+		lock_sock(sk);
 		/* Socket must be connected */
-		if (sk->sk_state != BT_CONNECTED)
+		if (sk->sk_state != BT_CONNECTED) {
+			release_sock(sk);
 			return -EBADFD;
+		}
 
 		dlc = rfcomm_pi(sk)->dlc;
 		rfcomm_dlc_hold(dlc);
@@ -422,13 +425,13 @@ static int __rfcomm_create_dev(struct sock *sk, void __user *arg)
 	}
 
 	id = rfcomm_dev_add(&req, dlc);
-	if (id < 0)
-		return id;
 
 	if (req.flags & (1 << RFCOMM_REUSE_DLC)) {
 		/* DLC is now used by device.
 		 * Socket must be disconnected */
-		sk->sk_state = BT_CLOSED;
+		if (!(id < 0))
+			sk->sk_state = BT_CLOSED;
+		release_sock(sk);
 	}
 
 	return id;
-- 
2.42.1

RE: Bluetooth: RFCOMM: possible deadlock in rfcomm_dlc_exists

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2747 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=851144

---Test result---

Test Summary:
CheckPatch                    PASS      0.94 seconds
GitLint                       PASS      0.27 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      30.21 seconds
CheckAllWarning               PASS      33.33 seconds
CheckSparse                   PASS      38.87 seconds
CheckSmatch                   FAIL      36.55 seconds
BuildKernel32                 PASS      29.16 seconds
TestRunnerSetup               PASS      526.28 seconds
TestRunner_l2cap-tester       PASS      18.55 seconds
TestRunner_iso-tester         FAIL      33.83 seconds
TestRunner_bnep-tester        PASS      4.72 seconds
TestRunner_mgmt-tester        PASS      107.38 seconds
TestRunner_rfcomm-tester      PASS      7.35 seconds
TestRunner_sco-tester         PASS      15.08 seconds
TestRunner_ioctl-tester       PASS      7.69 seconds
TestRunner_mesh-tester        PASS      5.76 seconds
TestRunner_smp-tester         PASS      6.77 seconds
TestRunner_userchan-tester    PASS      4.91 seconds
IncrementalBuild              PASS      28.57 seconds

Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:

Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bpa10x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bpa10x.o'
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
Total: 122, Passed: 121 (99.2%), Failed: 1, Not Run: 0

Failed Test Cases
ISO Connect2 Suspend - Success                       Failed       6.251 seconds


---
Regards,
Linux Bluetooth