Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 23:19:34 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bluetooth: RFCOMM: serialize session teardown

Browse Source 
rfcomm_kill_listener() walks session_list and deletes every session
without holding rfcomm_mutex, unlike the normal session processing and
connect error paths.

Under normal operation, an open RFCOMM socket pins rfcomm.ko, so
rfcomm_kill_listener() does not run concurrently with rfcomm_dlc_open().
However, forced module unload via delete_module(O_TRUNC) can stop
krfcommd while a failed connect is still unwinding.

  connect task                    forced unload / krfcommd
  ------------                    ------------------------
  rfcomm_lock()
  rfcomm_session_add()
                                  delete_module("rfcomm", O_TRUNC)
                                  rfcomm_kill_listener()
                                    fetch session from session_list
  kernel_connect() fails
  rfcomm_session_del()
    remove and free session
                                  rfcomm_session_del(session)

The final call then reads the freed session and may corrupt the list.

KASAN reported with mdelay() to enlarge critical window:

  BUG: KASAN: slab-use-after-free in rfcomm_run+0x3802/0x3f00 [rfcomm]
  Read of size 8 at addr ffff888111058d40 by task krfcommd/79
  Tainted: [R]=FORCED_RMMOD
  Allocated by task 86:
   rfcomm_session_add+0xa1/0x300 [rfcomm]
   rfcomm_dlc_open+0x8b2/0xf30 [rfcomm]
   rfcomm_sock_connect+0x34c/0x530 [rfcomm]
  Freed by task 86:
   kfree+0x121/0x3c0
   rfcomm_dlc_open+0xab7/0xf30 [rfcomm]
   rfcomm_sock_connect+0x34c/0x530 [rfcomm]

Hold rfcomm_mutex across the teardown traversal so every reachable
session_list walk uses the same serialization.

Reviewed-by: Ali Ahmet Memis <ali@iusegentoo.com>
Tested-by: Ali Ahmet Memis <ali@iusegentoo.com>
Reviewed-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Chengfeng Ye
2026-08-24 13:14:43 -04:00
committed by Luiz Augusto von Dentz
parent 7e1e404720
commit ebe6674292
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/rfcomm/core.c
+2
View File
@@ -2182,8 +2182,10 @@ static void rfcomm_kill_listener(void)
BT_DBG("");
rfcomm_lock();
list_for_each_entry_safe(s, n, &session_list, list)
rfcomm_session_del(s);
rfcomm_unlock();
}
static int rfcomm_run(void *unused)