* [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
@ 2024-09-30 19:30 Luiz Augusto von Dentz
2024-09-30 20:36 ` Luiz Augusto von Dentz
2024-10-01 16:10 ` [PATCH v1] Bluetooth: RFCOMM: FIX " patchwork-bot+bluetooth
0 siblings, 2 replies; 5+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-30 19:30 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
rfcomm_sk_state_change attempts to use sock_lock so it must never be
called with it locked but rfcomm_sock_ioctl always attempt to lock it
causing the following trace:
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:
ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
Reported-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
Fixes: 3241ad820dbb ("[Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/rfcomm/sock.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 37d63d768afb..f48250e3f2e1 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
if (err == -ENOIOCTLCMD) {
#ifdef CONFIG_BT_RFCOMM_TTY
- lock_sock(sk);
err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
- release_sock(sk);
#else
err = -EOPNOTSUPP;
#endif
--
2.46.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
2024-09-30 19:30 [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change Luiz Augusto von Dentz
@ 2024-09-30 20:36 ` Luiz Augusto von Dentz
2024-10-01 14:58 ` Luiz Augusto von Dentz
2024-10-01 16:10 ` [PATCH v1] Bluetooth: RFCOMM: FIX " patchwork-bot+bluetooth
1 sibling, 1 reply; 5+ messages in thread
From: Luiz Augusto von Dentz @ 2024-09-30 20:36 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot+d7ce59b06b3eb14fd218
On Mon, Sep 30, 2024 at 3:30 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> rfcomm_sk_state_change attempts to use sock_lock so it must never be
> called with it locked but rfcomm_sock_ioctl always attempt to lock it
> causing the following trace:
>
> ======================================================
> WARNING: possible circular locking dependency detected
> 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
> ------------------------------------------------------
> syz-executor386/5093 is trying to acquire lock:
> ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
> ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
>
> but task is already holding lock:
> ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
>
> Reported-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
> Fixes: 3241ad820dbb ("[Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO")
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
> net/bluetooth/rfcomm/sock.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
> index 37d63d768afb..f48250e3f2e1 100644
> --- a/net/bluetooth/rfcomm/sock.c
> +++ b/net/bluetooth/rfcomm/sock.c
> @@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
>
> if (err == -ENOIOCTLCMD) {
> #ifdef CONFIG_BT_RFCOMM_TTY
> - lock_sock(sk);
> err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
> - release_sock(sk);
> #else
> err = -EOPNOTSUPP;
> #endif
> --
> 2.46.1
>
--
Luiz Augusto von Dentz
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
2024-09-30 20:36 ` Luiz Augusto von Dentz
@ 2024-10-01 14:58 ` Luiz Augusto von Dentz
2024-10-01 15:52 ` [syzbot] [bluetooth?] " syzbot
0 siblings, 1 reply; 5+ messages in thread
From: Luiz Augusto von Dentz @ 2024-10-01 14:58 UTC (permalink / raw)
To: linux-bluetooth; +Cc: syzbot+d7ce59b06b3eb14fd218
[-- Attachment #1: Type: text/plain, Size: 2263 bytes --]
#syz test
On Mon, Sep 30, 2024 at 4:36 PM Luiz Augusto von Dentz
<luiz.dentz@gmail.com> wrote:
>
> On Mon, Sep 30, 2024 at 3:30 PM Luiz Augusto von Dentz
> <luiz.dentz@gmail.com> wrote:
> >
> > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> >
> > rfcomm_sk_state_change attempts to use sock_lock so it must never be
> > called with it locked but rfcomm_sock_ioctl always attempt to lock it
> > causing the following trace:
> >
> > ======================================================
> > WARNING: possible circular locking dependency detected
> > 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
> > ------------------------------------------------------
> > syz-executor386/5093 is trying to acquire lock:
> > ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
> > ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
> >
> > but task is already holding lock:
> > ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
> >
> > Reported-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
> > Fixes: 3241ad820dbb ("[Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO")
> > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > ---
> > net/bluetooth/rfcomm/sock.c | 2 --
> > 1 file changed, 2 deletions(-)
> >
> > diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
> > index 37d63d768afb..f48250e3f2e1 100644
> > --- a/net/bluetooth/rfcomm/sock.c
> > +++ b/net/bluetooth/rfcomm/sock.c
> > @@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
> >
> > if (err == -ENOIOCTLCMD) {
> > #ifdef CONFIG_BT_RFCOMM_TTY
> > - lock_sock(sk);
> > err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
> > - release_sock(sk);
> > #else
> > err = -EOPNOTSUPP;
> > #endif
> > --
> > 2.46.1
> >
>
>
> --
> Luiz Augusto von Dentz
--
Luiz Augusto von Dentz
[-- Attachment #2: v1-0001-Bluetooth-RFCOMM-FIX-possible-deadlock-in-rfcomm_.patch --]
[-- Type: text/x-patch, Size: 1925 bytes --]
From 9d651555ea532485cc38e759134e0c231c890eab Mon Sep 17 00:00:00 2001
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Mon, 30 Sep 2024 13:26:21 -0400
Subject: [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in
rfcomm_sk_state_change
rfcomm_sk_state_change attempts to use sock_lock so it must never be
called with it locked but rfcomm_sock_ioctl always attempt to lock it
causing the following trace:
======================================================
WARNING: possible circular locking dependency detected
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
------------------------------------------------------
syz-executor386/5093 is trying to acquire lock:
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1671 [inline]
ffff88807c396258 (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+.}-{0:0}, at: rfcomm_sk_state_change+0x5b/0x310 net/bluetooth/rfcomm/sock.c:73
but task is already holding lock:
ffff88807badfd28 (&d->lock){+.+.}-{3:3}, at: __rfcomm_dlc_close+0x226/0x6a0 net/bluetooth/rfcomm/core.c:491
Reported-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
Fixes: 3241ad820dbb ("[Bluetooth] Add timestamp support to L2CAP, RFCOMM and SCO")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/rfcomm/sock.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 37d63d768afb..f48250e3f2e1 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -865,9 +865,7 @@ static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned lon
if (err == -ENOIOCTLCMD) {
#ifdef CONFIG_BT_RFCOMM_TTY
- lock_sock(sk);
err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
- release_sock(sk);
#else
err = -EOPNOTSUPP;
#endif
--
2.46.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [syzbot] [bluetooth?] possible deadlock in rfcomm_sk_state_change
2024-10-01 14:58 ` Luiz Augusto von Dentz
@ 2024-10-01 15:52 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2024-10-01 15:52 UTC (permalink / raw)
To: linux-bluetooth, linux-kernel, luiz.dentz, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
Tested-by: syzbot+d7ce59b06b3eb14fd218@syzkaller.appspotmail.com
Tested on:
commit: e32cde8d Merge tag 'sched_ext-for-6.12-rc1-fixes-1' of..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12a33dd0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c9c87051d13eb9da
dashboard link: https://syzkaller.appspot.com/bug?extid=d7ce59b06b3eb14fd218
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=139c139f980000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
2024-09-30 19:30 [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change Luiz Augusto von Dentz
2024-09-30 20:36 ` Luiz Augusto von Dentz
@ 2024-10-01 16:10 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 5+ messages in thread
From: patchwork-bot+bluetooth @ 2024-10-01 16:10 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: linux-bluetooth
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Mon, 30 Sep 2024 15:30:44 -0400 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> rfcomm_sk_state_change attempts to use sock_lock so it must never be
> called with it locked but rfcomm_sock_ioctl always attempt to lock it
> causing the following trace:
>
> ======================================================
> WARNING: possible circular locking dependency detected
> 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Not tainted
>
> [...]
Here is the summary with links:
- [v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
https://git.kernel.org/bluetooth/bluetooth-next/c/ffb3f98d4dae
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-10-01 16:10 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-09-30 19:30 [PATCH v1] Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change Luiz Augusto von Dentz
2024-09-30 20:36 ` Luiz Augusto von Dentz
2024-10-01 14:58 ` Luiz Augusto von Dentz
2024-10-01 15:52 ` [syzbot] [bluetooth?] " syzbot
2024-10-01 16:10 ` [PATCH v1] Bluetooth: RFCOMM: FIX " patchwork-bot+bluetooth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox