lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 298/862] Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
    Date
    From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

    [ Upstream commit 3124d320c22f3f4388d9ac5c8f37eaad0cefd6b1 ]

    syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1],
    for rcu_sync_enter() is called without rcu_sync_init() due to
    hci_uart_tty_open() ignoring percpu_init_rwsem() failure.

    While we are at it, fix that hci_uart_register_device() ignores
    percpu_init_rwsem() failure and hci_uart_unregister_device() does not
    call percpu_free_rwsem().

    Link: https://syzkaller.appspot.com/bug?extid=576dfca25381fb6fbc5f [1]
    Reported-by: syzbot <syzbot+576dfca25381fb6fbc5f@syzkaller.appspotmail.com>
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Fixes: 67d2f8781b9f00d1 ("Bluetooth: hci_ldisc: Allow sleeping while proto locks are held.")
    Fixes: d73e172816652772 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops")
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/bluetooth/hci_ldisc.c | 7 +++++--
    drivers/bluetooth/hci_serdev.c | 10 +++++++---
    2 files changed, 12 insertions(+), 5 deletions(-)

    diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
    index f537673ede17..865112e96ff9 100644
    --- a/drivers/bluetooth/hci_ldisc.c
    +++ b/drivers/bluetooth/hci_ldisc.c
    @@ -493,6 +493,11 @@ static int hci_uart_tty_open(struct tty_struct *tty)
    BT_ERR("Can't allocate control structure");
    return -ENFILE;
    }
    + if (percpu_init_rwsem(&hu->proto_lock)) {
    + BT_ERR("Can't allocate semaphore structure");
    + kfree(hu);
    + return -ENOMEM;
    + }

    tty->disc_data = hu;
    hu->tty = tty;
    @@ -505,8 +510,6 @@ static int hci_uart_tty_open(struct tty_struct *tty)
    INIT_WORK(&hu->init_ready, hci_uart_init_work);
    INIT_WORK(&hu->write_work, hci_uart_write_work);

    - percpu_init_rwsem(&hu->proto_lock);
    -
    /* Flush any pending characters in the driver */
    tty_driver_flush_buffer(tty);

    diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
    index c0e5f42ec6b7..f16fd79bc02b 100644
    --- a/drivers/bluetooth/hci_serdev.c
    +++ b/drivers/bluetooth/hci_serdev.c
    @@ -310,11 +310,12 @@ int hci_uart_register_device(struct hci_uart *hu,

    serdev_device_set_client_ops(hu->serdev, &hci_serdev_client_ops);

    + if (percpu_init_rwsem(&hu->proto_lock))
    + return -ENOMEM;
    +
    err = serdev_device_open(hu->serdev);
    if (err)
    - return err;
    -
    - percpu_init_rwsem(&hu->proto_lock);
    + goto err_rwsem;

    err = p->open(hu);
    if (err)
    @@ -389,6 +390,8 @@ int hci_uart_register_device(struct hci_uart *hu,
    p->close(hu);
    err_open:
    serdev_device_close(hu->serdev);
    +err_rwsem:
    + percpu_free_rwsem(&hu->proto_lock);
    return err;
    }
    EXPORT_SYMBOL_GPL(hci_uart_register_device);
    @@ -410,5 +413,6 @@ void hci_uart_unregister_device(struct hci_uart *hu)
    clear_bit(HCI_UART_PROTO_READY, &hu->flags);
    serdev_device_close(hu->serdev);
    }
    + percpu_free_rwsem(&hu->proto_lock);
    }
    EXPORT_SYMBOL_GPL(hci_uart_unregister_device);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 12:53    [W:4.028 / U:0.620 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site