| Message ID | 20241029194505.2094645-2-iam@sung-woo.kim (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | af524ed29eee9390eb1a60d7b7b56bc5afe68560 |
| Headers | show |
| Series | [v3] Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs | expand |
| Context | Check | Description |
|---|---|---|
| tedd_an/pre-ci_am | success | Success |
| tedd_an/CheckPatch | warning | WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?) #92: CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 total: 0 errors, 1 warnings, 0 checks, 36 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. /github/workspace/src/src/13855347.patch has style problems, please review. NOTE: Ignored message types: UNKNOWN_COMMIT_ID NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. |
| tedd_an/GitLint | fail | WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search 18: B1 Line exceeds max length (199>80): "Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78" |
| tedd_an/SubjectPrefix | success | Gitlint PASS |
| tedd_an/BuildKernel | success | BuildKernel PASS |
| tedd_an/CheckAllWarning | success | CheckAllWarning PASS |
| tedd_an/CheckSparse | success | CheckSparse PASS |
Hi Sungwoo, On Tue, Oct 29, 2024 at 3:47 PM Sungwoo Kim <iam@sung-woo.kim> wrote: > > Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. > > __hci_cmd_sync_sk() returns NULL if a command returns a status event. > However, it also returns NULL where an opcode doesn't exist in the > hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0] > for unknown opcodes. > This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as > there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes > status = skb->data[0]. > > KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] > CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > Workqueue: hci7 hci_power_on > RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138 > Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78 > RSP: 0018:ffff888120bafac8 EFLAGS: 00010212 > RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040 > RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4 > RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054 > R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070 > R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000 > FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0 > PKRU: 55555554 > Call Trace: > <TASK> > hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline] > hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline] > hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline] > hci_init_sync net/bluetooth/hci_sync.c:4742 [inline] > hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline] > hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994 > hci_dev_do_open net/bluetooth/hci_core.c:483 [inline] > hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015 > process_one_work kernel/workqueue.c:3267 [inline] > process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348 > worker_thread+0x91f/0xe50 kernel/workqueue.c:3429 > kthread+0x2cb/0x360 kernel/kthread.c:388 > ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 > > Fixes: abfeea476c68 ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY") > > Signed-off-by: Sungwoo Kim <iam@sung-woo.kim> > --- > v1 -> v2: make __hci_cmd_sync_sk() not return NULL > v2 -> v3: elaborate reasoning > > net/bluetooth/hci_sync.c | 18 +++++++++++------- > 1 file changed, 11 insertions(+), 7 deletions(-) > > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c > index 9482bd562..c86f4e42e 100644 > --- a/net/bluetooth/hci_sync.c > +++ b/net/bluetooth/hci_sync.c > @@ -206,6 +206,12 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, > return ERR_PTR(err); > } > > + /* If command return a status event skb will be set to NULL as there are > + * no parameters. > + */ > + if (!skb) > + return ERR_PTR(-ENODATA); > + > return skb; > } > EXPORT_SYMBOL(__hci_cmd_sync_sk); > @@ -255,6 +261,11 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, > u8 status; > > skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk); > + > + /* If command return a status event, skb will be set to -ENODATA */ > + if (skb == ERR_PTR(-ENODATA)) > + return 0; > + > if (IS_ERR(skb)) { > if (!event) > bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode, > @@ -262,13 +273,6 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, > return PTR_ERR(skb); > } > > - /* If command return a status event skb will be set to NULL as there are > - * no parameters, in case of failure IS_ERR(skb) would have be set to > - * the actual error would be found with PTR_ERR(skb). > - */ > - if (!skb) > - return 0; > - > status = skb->data[0]; > > kfree_skb(skb); > -- > 2.43.0 There is something not quite right with this one, it seems to be causing some errors with the likes of mgmt-tester in particular 'Read Ext Controller Info', for some reason the index is not 0 so I suspect something is not working as intended due to these changes.
Hi Sungwoo, On Wed, Oct 30, 2024 at 10:26 AM Luiz Augusto von Dentz <luiz.dentz@gmail.com> wrote: > > Hi Sungwoo, > > On Tue, Oct 29, 2024 at 3:47 PM Sungwoo Kim <iam@sung-woo.kim> wrote: > > > > Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. > > > > __hci_cmd_sync_sk() returns NULL if a command returns a status event. > > However, it also returns NULL where an opcode doesn't exist in the > > hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0] > > for unknown opcodes. > > This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as > > there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes > > status = skb->data[0]. > > > > KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] > > CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > > Workqueue: hci7 hci_power_on > > RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138 > > Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78 > > RSP: 0018:ffff888120bafac8 EFLAGS: 00010212 > > RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040 > > RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4 > > RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054 > > R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070 > > R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000 > > FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 > > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0 > > PKRU: 55555554 > > Call Trace: > > <TASK> > > hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline] > > hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline] > > hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline] > > hci_init_sync net/bluetooth/hci_sync.c:4742 [inline] > > hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline] > > hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994 > > hci_dev_do_open net/bluetooth/hci_core.c:483 [inline] > > hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015 > > process_one_work kernel/workqueue.c:3267 [inline] > > process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348 > > worker_thread+0x91f/0xe50 kernel/workqueue.c:3429 > > kthread+0x2cb/0x360 kernel/kthread.c:388 > > ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 > > > > Fixes: abfeea476c68 ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY") > > > > Signed-off-by: Sungwoo Kim <iam@sung-woo.kim> > > --- > > v1 -> v2: make __hci_cmd_sync_sk() not return NULL > > v2 -> v3: elaborate reasoning > > > > net/bluetooth/hci_sync.c | 18 +++++++++++------- > > 1 file changed, 11 insertions(+), 7 deletions(-) > > > > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c > > index 9482bd562..c86f4e42e 100644 > > --- a/net/bluetooth/hci_sync.c > > +++ b/net/bluetooth/hci_sync.c > > @@ -206,6 +206,12 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, > > return ERR_PTR(err); > > } > > > > + /* If command return a status event skb will be set to NULL as there are > > + * no parameters. > > + */ > > + if (!skb) > > + return ERR_PTR(-ENODATA); > > + > > return skb; > > } > > EXPORT_SYMBOL(__hci_cmd_sync_sk); > > @@ -255,6 +261,11 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, > > u8 status; > > > > skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk); > > + > > + /* If command return a status event, skb will be set to -ENODATA */ > > + if (skb == ERR_PTR(-ENODATA)) > > + return 0; > > + > > if (IS_ERR(skb)) { > > if (!event) > > bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode, > > @@ -262,13 +273,6 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, > > return PTR_ERR(skb); > > } > > > > - /* If command return a status event skb will be set to NULL as there are > > - * no parameters, in case of failure IS_ERR(skb) would have be set to > > - * the actual error would be found with PTR_ERR(skb). > > - */ > > - if (!skb) > > - return 0; > > - > > status = skb->data[0]; > > > > kfree_skb(skb); > > -- > > 2.43.0 > > There is something not quite right with this one, it seems to be > causing some errors with the likes of mgmt-tester in particular 'Read > Ext Controller Info', for some reason the index is not 0 so I suspect > something is not working as intended due to these changes. Nevermind, the culprit is another change. > -- > Luiz Augusto von Dentz
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>: On Tue, 29 Oct 2024 19:44:41 +0000 you wrote: > Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. > > __hci_cmd_sync_sk() returns NULL if a command returns a status event. > However, it also returns NULL where an opcode doesn't exist in the > hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0] > for unknown opcodes. > This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as > there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes > status = skb->data[0]. > > [...] Here is the summary with links: - [v3] Bluetooth: hci: fix null-ptr-deref in hci_read_supported_codecs https://git.kernel.org/bluetooth/bluetooth-next/c/af524ed29eee You are awesome, thank you!
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 9482bd562..c86f4e42e 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -206,6 +206,12 @@ struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, return ERR_PTR(err); } + /* If command return a status event skb will be set to NULL as there are + * no parameters. + */ + if (!skb) + return ERR_PTR(-ENODATA); + return skb; } EXPORT_SYMBOL(__hci_cmd_sync_sk); @@ -255,6 +261,11 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, u8 status; skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk); + + /* If command return a status event, skb will be set to -ENODATA */ + if (skb == ERR_PTR(-ENODATA)) + return 0; + if (IS_ERR(skb)) { if (!event) bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode, @@ -262,13 +273,6 @@ int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, return PTR_ERR(skb); } - /* If command return a status event skb will be set to NULL as there are - * no parameters, in case of failure IS_ERR(skb) would have be set to - * the actual error would be found with PTR_ERR(skb). - */ - if (!skb) - return 0; - status = skb->data[0]; kfree_skb(skb);
Fix __hci_cmd_sync_sk() to return not NULL for unknown opcodes. __hci_cmd_sync_sk() returns NULL if a command returns a status event. However, it also returns NULL where an opcode doesn't exist in the hci_cc table because hci_cmd_complete_evt() assumes status = skb->data[0] for unknown opcodes. This leads to null-ptr-deref in cmd_sync for HCI_OP_READ_LOCAL_CODECS as there is no hci_cc for HCI_OP_READ_LOCAL_CODECS, which always assumes status = skb->data[0]. KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 2000 Comm: kworker/u9:5 Not tainted 6.9.0-ga6bcb805883c-dirty #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: hci7 hci_power_on RIP: 0010:hci_read_supported_codecs+0xb9/0x870 net/bluetooth/hci_codec.c:138 Code: 08 48 89 ef e8 b8 c1 8f fd 48 8b 75 00 e9 96 00 00 00 49 89 c6 48 ba 00 00 00 00 00 fc ff df 4c 8d 60 70 4c 89 e3 48 c1 eb 03 <0f> b6 04 13 84 c0 0f 85 82 06 00 00 41 83 3c 24 02 77 0a e8 bf 78 RSP: 0018:ffff888120bafac8 EFLAGS: 00010212 RAX: 0000000000000000 RBX: 000000000000000e RCX: ffff8881173f0040 RDX: dffffc0000000000 RSI: ffffffffa58496c0 RDI: ffff88810b9ad1e4 RBP: ffff88810b9ac000 R08: ffffffffa77882a7 R09: 1ffffffff4ef1054 R10: dffffc0000000000 R11: fffffbfff4ef1055 R12: 0000000000000070 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88810b9ac000 FS: 0000000000000000(0000) GS:ffff8881f6c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6ddaa3439e CR3: 0000000139764003 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <TASK> hci_read_local_codecs_sync net/bluetooth/hci_sync.c:4546 [inline] hci_init_stage_sync net/bluetooth/hci_sync.c:3441 [inline] hci_init4_sync net/bluetooth/hci_sync.c:4706 [inline] hci_init_sync net/bluetooth/hci_sync.c:4742 [inline] hci_dev_init_sync net/bluetooth/hci_sync.c:4912 [inline] hci_dev_open_sync+0x19a9/0x2d30 net/bluetooth/hci_sync.c:4994 hci_dev_do_open net/bluetooth/hci_core.c:483 [inline] hci_power_on+0x11e/0x560 net/bluetooth/hci_core.c:1015 process_one_work kernel/workqueue.c:3267 [inline] process_scheduled_works+0x8ef/0x14f0 kernel/workqueue.c:3348 worker_thread+0x91f/0xe50 kernel/workqueue.c:3429 kthread+0x2cb/0x360 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Fixes: abfeea476c68 ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY") Signed-off-by: Sungwoo Kim <iam@sung-woo.kim> --- v1 -> v2: make __hci_cmd_sync_sk() not return NULL v2 -> v3: elaborate reasoning net/bluetooth/hci_sync.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)