Luiz Augusto von Dentz
6fe26f694c
Bluetooth: MGMT: Protect mgmt_pending list with its own lock
This uses a mutex to protect from concurrent access of mgmt_pending
list which can cause crashes like:
==================================================================
BUG: KASAN: slab-use-after-free in hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91
Read of size 2 at addr ffff0000c48885b2 by task syz.4.334/7318
CPU: 0 UID: 0 PID: 7318 Comm: syz.4.334 Not tainted 6.15.0-rc7-syzkaller-g187899f4124a #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xa8/0x254 mm/kasan/report.c:408
print_report+0x68/0x84 mm/kasan/report.c:521
kasan_report+0xb0/0x110 mm/kasan/report.c:634
__asan_report_load2_noabort+0x20/0x2c mm/kasan/report_generic.c:379
hci_sock_get_channel+0x60/0x68 net/bluetooth/hci_sock.c:91
mgmt_pending_find+0x7c/0x140 net/bluetooth/mgmt_util.c:223
pending_find net/bluetooth/mgmt.c:947 [inline]
remove_adv_monitor+0x44/0x1a4 net/bluetooth/mgmt.c:5445
hci_mgmt_cmd+0x780/0xc00 net/bluetooth/hci_sock.c:1712
hci_sock_sendmsg+0x544/0xbb0 net/bluetooth/hci_sock.c:1832
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg net/socket.c:727 [inline]
sock_write_iter+0x25c/0x378 net/socket.c:1131
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x62c/0x97c fs/read_write.c:684
ksys_write+0x120/0x210 fs/read_write.c:736
__do_sys_write fs/read_write.c:747 [inline]
__se_sys_write fs/read_write.c:744 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:744
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Allocated by task 7037:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:68
kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:562
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_noprof+0x2fc/0x4c8 mm/slub.c:4339
kmalloc_noprof include/linux/slab.h:909 [inline]
sk_prot_alloc+0xc4/0x1f0 net/core/sock.c:2198
sk_alloc+0x44/0x3ac net/core/sock.c:2254
bt_sock_alloc+0x4c/0x300 net/bluetooth/af_bluetooth.c:148
hci_sock_create+0xa8/0x194 net/bluetooth/hci_sock.c:2202
bt_sock_create+0x14c/0x24c net/bluetooth/af_bluetooth.c:132
__sock_create+0x43c/0x91c net/socket.c:1541
sock_create net/socket.c:1599 [inline]
__sys_socket_create net/socket.c:1636 [inline]
__sys_socket+0xd4/0x1c0 net/socket.c:1683
__do_sys_socket net/socket.c:1697 [inline]
__se_sys_socket net/socket.c:1695 [inline]
__arm64_sys_socket+0x7c/0x94 net/socket.c:1695
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
el0_svc+0x58/0x17c arch/arm64/kernel/entry-common.c:767
el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600
Freed by task 6607:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:68
kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x68/0x88 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2380 [inline]
slab_free mm/slub.c:4642 [inline]
kfree+0x17c/0x474 mm/slub.c:4841
sk_prot_free net/core/sock.c:2237 [inline]
__sk_destruct+0x4f4/0x760 net/core/sock.c:2332
sk_destruct net/core/sock.c:2360 [inline]
__sk_free+0x320/0x430 net/core/sock.c:2371
sk_free+0x60/0xc8 net/core/sock.c:2382
sock_put include/net/sock.h:1944 [inline]
mgmt_pending_free+0x88/0x118 net/bluetooth/mgmt_util.c:290
mgmt_pending_remove+0xec/0x104 net/bluetooth/mgmt_util.c:298
mgmt_set_powered_complete+0x418/0x5cc net/bluetooth/mgmt.c:1355
hci_cmd_sync_work+0x204/0x33c net/bluetooth/hci_sync.c:334
process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x958/0xed8 kernel/workqueue.c:3400
kthread+0x5fc/0x75c kernel/kthread.c:464
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847
Fixes: a380b6cff1 ("Bluetooth: Add generic mgmt helper API")
Closes: https://syzkaller.appspot.com/bug?extid=0a7039d5d9986ff4ecec
Closes: https://syzkaller.appspot.com/bug?extid=cc0cc52e7f43dc9e6df1
Reported-by: syzbot+0a7039d5d9986ff4ecec@syzkaller.appspotmail.com
Tested-by: syzbot+0a7039d5d9986ff4ecec@syzkaller.appspotmail.com
Tested-by: syzbot+cc0cc52e7f43dc9e6df1@syzkaller.appspotmail.com
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-06-05 14:54:57 -04:00
..
2024-05-01 18:07:37 +01:00
2025-06-05 14:54:57 -04:00
2024-10-08 15:33:49 -07:00
2024-12-09 14:44:59 -08:00
2025-02-14 10:58:08 -08:00
2025-05-28 08:30:46 +02:00
2025-05-23 13:57:14 +02:00
2025-04-24 09:29:56 +02:00
2024-11-07 10:21:58 +01:00
2025-04-16 18:17:57 -07:00
2024-10-24 16:03:40 +02:00
2025-05-27 18:18:55 -07:00
2024-01-02 12:41:16 +00:00
2024-10-23 11:43:47 +02:00
2025-01-20 12:16:04 -08:00
2025-04-24 17:03:45 -07:00
2025-03-26 09:31:18 -07:00
2025-05-27 11:05:21 +02:00
2022-07-22 12:53:22 +01:00
2023-03-21 21:32:18 -07:00
2025-03-24 10:26:53 +00:00
2022-08-09 22:14:02 -07:00
2021-12-13 12:34:09 +00:00
2024-08-26 09:37:22 -07:00
2024-08-26 09:37:22 -07:00
2024-11-14 11:16:28 +01:00
2025-03-25 08:00:09 -07:00
2021-03-26 17:43:55 +01:00
2025-02-27 14:03:14 +01:00
2024-10-02 17:23:23 -04:00
2022-11-16 11:31:47 +02:00
2025-04-23 18:03:30 +02:00
2024-03-06 21:01:26 +01:00
2025-05-30 19:53:51 -07:00
2024-10-02 17:23:23 -04:00
2021-12-22 15:03:47 -08:00
2022-07-22 12:53:22 +01:00
2023-07-14 20:39:29 -07:00
2022-07-24 18:39:17 -06:00
2023-07-27 17:17:32 -07:00
2022-07-22 12:53:22 +01:00
2023-01-20 09:33:22 +00:00
2025-05-06 18:21:11 -07:00
2025-05-26 10:03:13 +01:00
2025-02-11 11:58:17 +01:00
2023-10-24 13:08:14 -07:00
2025-05-09 16:34:09 -07:00
2024-05-08 10:35:09 +01:00
2024-08-26 09:37:23 -07:00
2025-02-20 13:17:16 -08:00
2024-05-29 17:34:49 -07:00
2024-12-09 14:44:59 -08:00
2024-11-13 18:49:50 -08:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2024-04-01 21:27:08 -07:00
2022-07-22 12:53:22 +01:00
2021-12-06 16:06:02 -08:00
2024-10-11 15:35:05 -07:00
2025-04-15 17:54:56 -07:00
2022-07-28 22:21:54 -07:00
2024-07-15 09:14:39 -07:00
2024-10-30 17:33:53 -07:00
2025-04-29 16:22:25 +02:00
2023-04-12 16:40:39 -07:00
2022-12-01 15:09:10 +01:00
2023-08-08 15:58:23 -07:00
2022-07-22 12:53:22 +01:00
2021-10-18 12:54:41 +01:00
2024-12-09 14:44:59 -08:00
2022-10-31 10:43:04 +00:00
2024-04-01 10:49:28 +01:00
2025-02-27 14:03:14 +01:00
2023-06-10 00:11:41 -07:00
2024-05-07 01:35:55 +02:00
2022-07-22 12:53:22 +01:00
2023-07-28 14:07:59 -07:00
2025-03-24 13:58:22 -07:00
2024-08-26 09:37:23 -07:00
2021-06-28 14:29:45 -07:00
2024-05-08 10:35:09 +01:00
2024-10-25 10:44:41 +01:00
2023-11-20 11:43:03 +01:00
2024-02-26 18:40:34 -08:00
2025-03-24 12:10:13 -07:00
2025-03-03 15:44:19 -08:00
2024-05-13 18:19:09 -06:00
2025-03-25 10:34:33 -07:00
2022-02-07 20:12:45 -08:00
2021-10-15 11:33:08 +01:00
2025-03-18 13:18:36 +01:00
2025-04-11 18:58:11 -07:00
2025-01-06 13:49:38 -08:00
2024-12-11 20:17:33 -08:00
2024-12-17 19:37:00 -08:00
2024-02-28 11:19:41 +00:00
2021-11-16 13:16:54 +00:00
2025-04-24 09:29:56 +02:00
2024-07-14 07:34:16 -07:00
2024-04-01 10:49:28 +01:00
2025-04-29 16:22:25 +02:00
2025-04-14 17:08:42 -07:00
2023-04-22 01:39:41 +02:00
2025-04-03 15:32:08 -07:00
2025-03-21 17:36:49 +08:00
2022-07-22 12:53:22 +01:00
2025-03-18 13:18:36 +01:00
2024-08-05 16:27:26 -07:00
2025-03-25 07:31:24 -07:00
2024-10-09 08:53:01 +02:00
2024-08-19 18:36:12 -07:00
2025-04-15 17:54:56 -07:00
2024-12-06 17:43:08 -08:00
2023-08-04 15:33:17 -07:00
2023-08-04 15:33:17 -07:00
2024-07-15 08:51:01 -07:00
2023-07-20 10:46:28 +02:00
2021-10-13 09:40:46 -07:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2022-07-22 12:53:22 +01:00
2024-07-15 08:51:19 -07:00
2021-11-07 19:25:29 +00:00
2025-05-20 19:18:24 -07:00
2025-05-09 00:05:11 +02:00
2024-10-02 17:23:23 -04:00
2025-01-20 12:20:42 +00:00
2025-03-21 18:18:12 +01:00
2024-11-09 09:04:54 -08:00
2021-03-26 15:14:56 -07:00
2022-07-22 12:53:22 +01:00
2025-04-15 08:21:46 -07:00
2022-11-18 12:14:55 +00:00
2022-07-22 12:53:22 +01:00
2024-08-12 17:23:57 -07:00
2024-11-09 13:22:57 -08:00
2024-11-09 13:22:57 -08:00
2024-11-30 13:41:50 -08:00
2025-04-14 17:08:45 -07:00
2024-10-10 08:30:22 -07:00
2021-12-10 06:38:26 -08:00
2025-05-22 09:42:41 -07:00
2025-03-12 13:32:35 -07:00
2025-05-19 20:09:02 -07:00
2025-04-09 17:01:51 -07:00
2022-07-22 12:53:22 +01:00
2023-11-20 10:15:16 -08:00
2024-11-21 08:28:08 -08:00
2025-05-12 18:50:09 -07:00
2025-05-13 11:12:49 +02:00
2022-07-22 12:53:22 +01:00
2025-04-24 09:29:56 +02:00
2024-08-30 22:30:55 +02:00
2023-07-14 20:39:29 -07:00
2024-04-01 10:49:28 +01:00
2023-07-14 20:39:30 -07:00
2023-06-02 09:55:22 +01:00
2025-01-20 09:21:27 +00:00
2024-02-02 10:57:55 -08:00
2022-07-22 12:53:22 +01:00
2024-04-30 18:46:52 -07:00
2024-03-07 21:12:43 -08:00
2024-07-11 18:11:31 -07:00
2022-07-22 12:53:22 +01:00
2023-04-06 12:01:20 -07:00
2023-03-17 08:56:37 +00:00
2024-08-26 09:37:23 -07:00
2024-08-26 09:37:23 -07:00
2024-06-06 15:18:04 +02:00
2022-08-01 11:59:23 -07:00
2025-04-29 16:22:25 +02:00
2023-06-19 11:32:58 -07:00
2025-05-16 16:03:48 -07:00
2023-07-14 20:39:30 -07:00
2025-04-11 18:58:10 -07:00
2025-02-21 15:28:03 -08:00
2025-05-15 11:28:30 -07:00
2025-05-23 10:24:18 +01:00
2025-04-11 18:58:10 -07:00
2024-05-30 18:29:38 -07:00
2024-06-24 16:41:23 -07:00
2024-05-30 18:29:38 -07:00
2021-04-28 14:06:45 -07:00
2024-04-30 13:24:48 +02:00
2025-03-16 22:05:53 -07:00
2024-08-02 17:16:59 -07:00
2025-05-23 10:24:18 +01:00
2023-10-04 11:49:20 -07:00
2022-07-22 12:53:22 +01:00
2025-05-05 16:48:12 -07:00
2024-02-16 09:36:37 +00:00
2024-02-14 10:49:37 +01:00
2024-11-03 12:10:11 -08:00
2023-12-04 14:45:26 -08:00
2025-04-10 18:29:26 -07:00
2024-07-08 14:07:31 -07:00
2024-05-09 20:25:55 -07:00
2023-07-28 14:07:59 -07:00
2024-12-16 12:47:29 +00:00
2023-08-01 15:06:27 -07:00
2022-12-12 15:04:39 -08:00
2022-07-22 12:53:22 +01:00
2025-04-14 14:29:01 -07:00
2025-04-08 18:19:41 -07:00
2023-09-14 16:16:36 +02:00
2025-04-22 11:11:16 +02:00
2024-08-26 09:37:23 -07:00
2022-07-22 12:53:22 +01:00
2025-02-20 15:13:45 -08:00
2025-04-24 17:11:33 -07:00
2025-04-22 19:57:56 -07:00
2025-05-26 18:32:48 +02:00
2025-04-24 17:11:52 -07:00