Skip to contentSkip to conversation

Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

PATCH In review Denis Efremov (Oracle) 2 participants 2 messages Sep 2, 2023

Subsystems (2)
Stable branch Bluetooth drivers
lore
Share & tools
lore

Denis Efremov (Oracle)

author
#0 lore raw

PATCH 1/1 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

From: Zheng Wang <[email protected]>

[ Upstream commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 ]

In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame.

If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove.

Fixes CVE-2023-1989
Fixes ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
Cc [email protected]
Signed-off-by Zheng Wang <[email protected]>
Signed-off-by Luiz Augusto von Dentz <[email protected]>
[ Denis: Added CVE-2023-1989 and fixes tags. ]
Signed-off-by Denis Efremov (Oracle) <[email protected]>

---

CVE-2023-1989 is 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. However, the fix was reverted and replaced with 73f7b171b7. In stable branches we've got only the original fix and its revert. I'm sending the replacement fix. One can find a reference to the new fix 73f7b171b7 in the revert commit db2bf510bd5d.

 drivers/bluetooth/btsdio.c | 1 +
 1 file changed, 1 insertion(+)
drivers/bluetooth/btsdio.c +1 -0
index 795be33f2892..f19d31ee37ea 100644
@@ -357,6 +357,7 @@ static void btsdio_remove(struct sdio_func *func)
 	if (!data)
 		return;
 
+	cancel_work_sync(&data->work);
 	hdev = data->hdev;
 
 	sdio_set_drvdata(func, NULL);
Signature · 1 line
2.42.0
maintainer
#1 lore raw
Quoted 18 lines · Denis Efremov (Oracle)

From: Zheng Wang <[email protected]>

[ Upstream commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 ]

In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame.

If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove.

Fixes CVE-2023-1989
Fixes ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
Cc [email protected]
Signed-off-by Zheng Wang <[email protected]>
Signed-off-by Luiz Augusto von Dentz <[email protected]>
[ Denis: Added CVE-2023-1989 and fixes tags. ]
Signed-off-by Denis Efremov (Oracle) <[email protected]>
Quoted 8 lines

---

CVE-2023-1989 is 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. However, the fix was reverted and replaced with 73f7b171b7. In stable branches we've got only the original fix and its revert. I'm sending the replacement fix. One can find a reference to the new fix 73f7b171b7 in the revert commit db2bf510bd5d.

Now queued up, thanks.

greg k-h