From: Artem Savkov Subject: [RHEL-7.9 CVE-2021-32399 KPATCH] bluetooth: eliminate the potential race condition when removing the HCI controller Date: Wed, 7 Jul 2021 17:13:32 +0200 Kernels: 3.10.0-1160.el7 3.10.0-1160.2.1.el7 3.10.0-1160.2.2.el7 3.10.0-1160.6.1.el7 3.10.0-1160.11.1.el7 3.10.0-1160.15.2.el7 3.10.0-1160.21.1.el7 3.10.0-1160.24.1.el7 3.10.0-1160.25.1.el7 3.10.0-1160.31.1.el7 Changes since last build: [x86_64]: hci_request.o: changed function: hci_req_sync [ppc64le]: hci_request.o: changed function: bg_scan_update hci_request.o: changed function: connectable_update_work hci_request.o: changed function: discov_off hci_request.o: changed function: discov_update hci_request.o: changed function: discoverable_update_work hci_request.o: changed function: hci_req_sync hci_request.o: changed function: le_scan_disable_work hci_request.o: changed function: le_scan_restart_work hci_request.o: changed function: scan_update_work --------------------------- Kernels: 3.10.0-1160.el7 3.10.0-1160.2.1.el7 3.10.0-1160.2.2.el7 3.10.0-1160.6.1.el7 3.10.0-1160.11.1.el7 3.10.0-1160.15.2.el7 3.10.0-1160.21.1.el7 3.10.0-1160.24.1.el7 3.10.0-1160.25.1.el7 3.10.0-1160.31.1.el7 3.10.0-1160.36.2.el7 Modifications: none Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-7/-/merge_requests/171 commit 168b363c94eac82c2e3531bd2ae9dfa2f369d4be Author: Gopal Tiwari Date: Mon Jun 14 13:04:00 2021 +0530 bluetooth: eliminate the potential race condition when removing the HCI controller Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1971457 Upstream: merged. Testing: Sanity_only. commit e2cb6b891ad2b8caa9131e3be70f45243df82a80 Author: Lin Ma Date: Mon Apr 12 19:17:57 2021 +0800 bluetooth: eliminate the potential race condition when removing the HCI controller There is a possible race condition vulnerability between issuing a HCI command and removing the cont. Specifically, functions hci_req_sync() and hci_dev_do_close() can race each other like below: thread-A in hci_req_sync() | thread-B in hci_dev_do_close() | hci_req_sync_lock(hdev); test_bit(HCI_UP, &hdev->flags); | ... | test_and_clear_bit(HCI_UP, &hdev->flags) hci_req_sync_lock(hdev); | | In this commit we alter the sequence in function hci_req_sync(). Hence, the thread-A cannot issue th. Signed-off-by: Lin Ma Cc: Marcel Holtmann Fixes: 7c6a329e4447 ("[Bluetooth] Fix regression from using default link policy") Signed-off-by: Greg Kroah-Hartman Signed-off-by: Gopal Tiwari Signed-off-by: Artem Savkov Acked-by: Joe Lawrence Acked-by: Yannick Cote --- net/bluetooth/hci_request.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c index 1015d9c8d97dd..9e25e77042503 100644 --- a/net/bluetooth/hci_request.c +++ b/net/bluetooth/hci_request.c @@ -275,12 +275,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req, { int ret; - if (!test_bit(HCI_UP, &hdev->flags)) - return -ENETDOWN; - /* Serialize all requests */ hci_req_sync_lock(hdev); - ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); + /* check the state after obtaing the lock to protect the HCI_UP + * against any races from hci_dev_do_close when the controller + * gets removed. + */ + if (test_bit(HCI_UP, &hdev->flags)) + ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); + else + ret = -ENETDOWN; hci_req_sync_unlock(hdev); return ret; -- 2.26.3