qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: Avoid potential use-after-free in hci_error_reset 

JIRA: https://issues.redhat.com/browse/RHEL-30099

JIRA: https://issues.redhat.com/browse/RHEL-31828

CVE: CVE-2024-26801

commit 2449007d3f73b2842c9734f45f0aadb522daf592
Author: Ying Hsu <yinghsu@chromium.org>
Date:   Thu Jan 4 11:56:32 2024 +0000

    Bluetooth: Avoid potential use-after-free in hci_error_reset

    While handling the HCI_EV_HARDWARE_ERROR event, if the underlying
    BT controller is not responding, the GPIO reset mechanism would
    free the hci_dev and lead to a use-after-free in hci_error_reset.

    Here's the call trace observed on a ChromeOS device with Intel AX201:
       queue_work_on+0x3e/0x6c
       __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>]
       ? init_wait_entry+0x31/0x31
       __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>]
       hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>]
       process_one_work+0x1d8/0x33f
       worker_thread+0x21b/0x373
       kthread+0x13a/0x152
       ? pr_cont_work+0x54/0x54
       ? kthread_blkcg+0x31/0x31
        ret_from_fork+0x1f/0x30

    This patch holds the reference count on the hci_dev while processing
    a HCI_EV_HARDWARE_ERROR event to avoid potential crash.

    Fixes: c7741d16a5 ("Bluetooth: Perform a power cycle when receiving hardware error event")
    Signed-off-by: Ying Hsu <yinghsu@chromium.org>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Signed-off-by: David Marlin <dmarlin@redhat.com>
This commit is contained in:
David Marlin 2024-03-22 14:00:47 -05:00
parent c00dac35bb
commit 7c9fa6c01b
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/bluetooth/hci_core.c
View File

@ -1049,6 +1049,7 @@ static void hci_error_reset(struct work_struct *work)
{
struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
hci_dev_hold(hdev);
BT_DBG("%s", hdev->name);
if (hdev->hw_error)
@ -1056,10 +1057,10 @@ static void hci_error_reset(struct work_struct *work)
else
bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
if (hci_dev_do_close(hdev))
return;
if (!hci_dev_do_close(hdev))
hci_dev_do_open(hdev);
hci_dev_do_open(hdev);
hci_dev_put(hdev);
}
void hci_uuids_clear(struct hci_dev *hdev)