[PATCH bluetooth v1] Bluetooth: hci_core: Initialize IRK before publication

[PATCH bluetooth v1] Bluetooth: hci_core: Initialize IRK before publication

[Binbin Deng]

hci_add_irk() initializes the identity address and address type of a newly
allocated IRK, publishes it on hdev->identity_resolving_keys, and only then
initializes its value and RPA.  RCU readers such as hci_find_irk_by_rpa()
and the debugfs identity_resolving_keys_show() can traverse the new entry
during that window and see a zero or partially initialized IRK.

The race is reachable by racing an IRK addition with another CPU resolving
or dumping IRKs.  In particular, userspace can issue MGMT_OP_LOAD_IRKS
while another process reads the corresponding debugfs file or triggers RPA
resolution.

Initialize the IRK value and RPA before publishing a newly allocated IRK.
Existing IRKs remain published and continue to be updated in place.

Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
not observed at runtime; it is identified by code inspection only.

Fixes: adae20cb2d20 ("Bluetooth: Convert IRK list to RCU")
Assisted-by: GLM-5.3 coccinelle
Signed-off-by: Binbin Deng <18983559317@163.com>
---
 net/bluetooth/hci_core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d183efaf9063..6d6d4eb1268a 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1315,9 +1315,10 @@ struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
 			    u8 addr_type, u8 val[16], bdaddr_t *rpa)
 {
-	struct smp_irk *irk;
+	struct smp_irk *irk, *old_irk;
 
-	irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
+	old_irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
+	irk = old_irk;
 	if (!irk) {
 		irk = kzalloc_obj(*irk);
 		if (!irk)
@@ -1326,12 +1327,14 @@ struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
 		bacpy(&irk->bdaddr, bdaddr);
 		irk->addr_type = addr_type;
 
-		list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
 	}
 
 	memcpy(irk->val, val, 16);
 	bacpy(&irk->rpa, rpa);
 
+	if (!old_irk)
+		list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
+
 	return irk;
 }
 
-- 
2.43.0

RE: [v1] Bluetooth: hci_core: Initialize IRK before publication

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1604 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1188835/

---Test result---

Test Summary:
CheckPatch                    PASS      0.55 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.24 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      23.86 seconds
CheckAllWarning               PASS      27.65 seconds
CheckSparse                   PASS      30.46 seconds
BuildKernel32                 PASS      23.89 seconds
CheckKernelLLVM               PASS      28.25 seconds
TestRunnerSetup               PASS      537.30 seconds
TestRunner_l2cap-tester       PASS      13.43 seconds
TestRunner_iso-tester         PASS      9.48 seconds
TestRunner_bnep-tester        PASS      2.81 seconds
TestRunner_mgmt-tester        PASS      88.49 seconds
TestRunner_rfcomm-tester      PASS      4.94 seconds
TestRunner_sco-tester         PASS      5.18 seconds
TestRunner_ioctl-tester       PASS      4.25 seconds
TestRunner_mesh-tester        PASS      5.56 seconds
TestRunner_smp-tester         PASS      4.00 seconds
TestRunner_userchan-tester    PASS      2.87 seconds
TestRunner_6lowpan-tester     PASS      3.98 seconds
IncrementalBuild              PASS      22.41 seconds



https://github.com/bluez/bluetooth-next/pull/965

---
Regards,
Linux Bluetooth

Re: [PATCH bluetooth v1] Bluetooth: hci_core: Initialize IRK before publication

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 19 Oct 2026 19:16:11 +0800 you wrote:
> hci_add_irk() initializes the identity address and address type of a newly
> allocated IRK, publishes it on hdev->identity_resolving_keys, and only then
> initializes its value and RPA.  RCU readers such as hci_find_irk_by_rpa()
> and the debugfs identity_resolving_keys_show() can traverse the new entry
> during that window and see a zero or partially initialized IRK.
> 
> The race is reachable by racing an IRK addition with another CPU resolving
> or dumping IRKs.  In particular, userspace can issue MGMT_OP_LOAD_IRKS
> while another process reads the corresponding debugfs file or triggers RPA
> resolution.
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: hci_core: Initialize IRK before publication
    https://git.kernel.org/bluetooth/bluetooth-next/c/7404cfafe3e2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html