| Context |
Check |
Description |
| tedd_an/pre-ci_am |
success
|
Success
|
| tedd_an/checkpatch |
success
|
Checkpatch PASS
|
| tedd_an/gitlint |
success
|
Gitlint PASS
|
| tedd_an/subjectprefix |
success
|
PASS
|
| tedd_an/buildkernel |
success
|
Build Kernel PASS
|
| tedd_an/buildkernel32 |
success
|
Build Kernel32 PASS
|
| tedd_an/incremental_build |
success
|
Pass
|
| tedd_an/testrunnersetup |
success
|
Test Runner Setup PASS
|
| tedd_an/testrunnerl2cap-tester |
success
|
Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnerbnep-tester |
success
|
Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnermgmt-tester |
success
|
Total: 493, Passed: 493 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnerrfcomm-tester |
success
|
Total: 10, Passed: 10 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnersco-tester |
success
|
Total: 12, Passed: 12 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunnersmp-tester |
success
|
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
|
| tedd_an/testrunneruserchan-tester |
success
|
Total: 4, Passed: 4 (100.0%), Failed: 0, Not Run: 0
|
@@ -1835,7 +1835,9 @@ static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
if (rp->status)
return rp->status;
+ hci_dev_lock(hdev);
hci_bdaddr_list_clear(&hdev->le_accept_list);
+ hci_dev_unlock(hdev);
return rp->status;
}
@@ -1855,8 +1857,10 @@ static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
if (!sent)
return rp->status;
+ hci_dev_lock(hdev);
hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
sent->bdaddr_type);
+ hci_dev_unlock(hdev);
return rp->status;
}
@@ -1876,8 +1880,10 @@ static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
if (!sent)
return rp->status;
+ hci_dev_lock(hdev);
hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
sent->bdaddr_type);
+ hci_dev_unlock(hdev);
return rp->status;
}
@@ -1949,9 +1955,11 @@ static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
if (!sent)
return rp->status;
+ hci_dev_lock(hdev);
hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
sent->bdaddr_type, sent->peer_irk,
sent->local_irk);
+ hci_dev_unlock(hdev);
return rp->status;
}
@@ -1971,8 +1979,10 @@ static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
if (!sent)
return rp->status;
+ hci_dev_lock(hdev);
hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
sent->bdaddr_type);
+ hci_dev_unlock(hdev);
return rp->status;
}
@@ -1987,7 +1997,9 @@ static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
if (rp->status)
return rp->status;
+ hci_dev_lock(hdev);
hci_bdaddr_list_clear(&hdev->le_resolv_list);
+ hci_dev_unlock(hdev);
return rp->status;
}
Concurrent operations from events on le_{accept,resolv}_list are currently unprotected by hdev->lock. Most existing code do already protect the lists with that lock. This can be observed in hci_debugfs and hci_sync. Add the protection for these events too. Fixes: b950aa88638c ("Bluetooth: Add definitions and track LE resolve list modification") Fixes: 0f36b589e4ee ("Bluetooth: Track LE white list modification via HCI commands") Signed-off-by: Niels Dossche <dossche.niels@gmail.com> --- Note: I am currently working on a static analyser to detect missing locks using type-based static analysis as my master's thesis in order to obtain my master's degree. If you would like to have more details, please let me know. This was a reported case. I manually verified the report by looking at the code, so that I do not send wrong information or patches. After concluding that this seems to be a true positive, I created this patch. This was compile-tested and runtime-tested on x86_64. This issue was found on Linux v5.17.4. net/bluetooth/hci_event.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)