[PW_SID:1154463] [v2] Bluetooth: hci_core: Fix IRK lookup lifetime races - #674
[PW_SID:1154463] [v2] Bluetooth: hci_core: Fix IRK lookup lifetime races#674BluezTestBot wants to merge 6 commits into
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
This replaces the bzcafe action with bluez/action-ci so we can maintain everything in the github bluez organization Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This attempts to sync every 5 minutes instead of 30. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
bluez/action-ci uses master as default branch for workflow which is incorrect for kernel Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The CI action now creates individual GitHub Check Runs per test, which requires 'checks: write' permission on the GITHUB_TOKEN. Also make the pull_request trigger types explicit to include 'reopened', allowing CI to be retriggered by closing and reopening a PR.
The IRK lookup helpers traverse the identity resolving key list under RCU, but return a raw pointer after leaving the read-side critical section. A concurrent management unpair or key reload can unlink and free that entry while SMP key distribution still updates its value and RPA through hci_add_irk(). RCU also does not serialize list mutations. SMP cleanup and key distribution can update the IRK list without the hdev mutex while management paths update it with that mutex held, allowing concurrent list_add_rcu() and list_del_rcu() operations on the same list. Give each IRK a list-owned reference and return caller-owned references from lookup and add helpers. Keep the SMP context reference until pairing teardown, and drop the list reference only once when an entry is unlinked. Add a dedicated spinlock for IRK list and payload updates, and copy payload snapshots under that lock so readers do not race updates. Initialize new entries completely before publishing them. Unlink an IRK added during unpair before dropping the SMP context reference. Make RPA lookup and caching linearizable with duplicate-key updates. After a cryptographic match outside the lock, revalidate the matched IRK value while acquiring the reference, updating the cache, and taking the payload snapshot under the lock. Perform cached-RPA matching and reference acquisition under that lock as well. This prevents an old-key match from caching its RPA in a replacement-key object and makes blocked key filtering use the payload that was actually matched. Add a CONFIG_BT_SELFTEST regression that models the exact stale-match state and verifies that it neither acquires a reference nor changes the replacement key's cached RPA. It also covers successful current-key cache updates and cached lookup reference balancing. Fixes: a7ec733 ("Bluetooth: Fix removing any IRKs when unpairing devices") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5 Signed-off-by: Kazuki Hanai <hnkz.64@gmail.com>
|
CheckPatch |
|
VerifyFixes |
|
VerifySignedoff |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
CheckKernelLLVM |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
TestRunner_6lowpan-tester |
|
IncrementalBuild |
5de3a3b to
45ffbf1
Compare
4 participants
The IRK lookup helpers traverse the identity resolving key list under
RCU, but return a raw pointer after leaving the read-side critical
section. A concurrent management unpair or key reload can unlink and
free that entry while SMP key distribution still updates its value and
RPA through hci_add_irk().
RCU also does not serialize list mutations. SMP cleanup and key
distribution can update the IRK list without the hdev mutex while
management paths update it with that mutex held, allowing concurrent
list_add_rcu() and list_del_rcu() operations on the same list.
Give each IRK a list-owned reference and return caller-owned references
from lookup and add helpers. Keep the SMP context reference until pairing
teardown, and drop the list reference only once when an entry is
unlinked. Add a dedicated spinlock for IRK list and payload updates, and
copy payload snapshots under that lock so readers do not race updates.
Initialize new entries completely before publishing them. Unlink an IRK
added during unpair before dropping the SMP context reference.
Make RPA lookup and caching linearizable with duplicate-key updates.
After a cryptographic match outside the lock, revalidate the matched IRK
value while acquiring the reference, updating the cache, and taking the
payload snapshot under the lock. Perform cached-RPA matching and
reference acquisition under that lock as well. This prevents an old-key
match from caching its RPA in a replacement-key object and makes blocked
key filtering use the payload that was actually matched.
Add a CONFIG_BT_SELFTEST regression that models the exact stale-match
state and verifies that it neither acquires a reference nor changes the
replacement key's cached RPA. It also covers successful current-key cache
updates and cached lookup reference balancing.
Fixes: a7ec733 ("Bluetooth: Fix removing any IRKs when unpairing devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Kazuki Hanai hnkz.64@gmail.com
Changes in v2:
trailer reported by CI.
caching the RPA and acquiring the caller reference. Also make cached
lookup, reference acquisition, and payload snapshot one locked step.
replacement key update, including rejected-path reference accounting.
Fresh matched baseline/patched runs passed mgmt-tester IRK (6/6),
mgmt-tester Privacy (30/30), and smp-tester (8/8) on both kernels.
tests were previously reproduced on the v1 base and patched kernels;
the handlers involved are unchanged here.
v1: https://lore.kernel.org/linux-bluetooth/20260828022549.1721170-1-hnkz.64@gmail.com/
include/net/bluetooth/hci_core.h | 19 +-
net/bluetooth/hci_conn.c | 34 +++-
net/bluetooth/hci_core.c | 311 +++++++++++++++++++++++++++----
net/bluetooth/hci_debugfs.c | 6 +-
net/bluetooth/hci_event.c | 16 +-
net/bluetooth/hci_sync.c | 16 +-
net/bluetooth/iso.c | 18 +-
net/bluetooth/mgmt.c | 12 +-
net/bluetooth/selftest.c | 4 +
net/bluetooth/selftest.h | 2 +
net/bluetooth/smp.c | 20 +-
11 files changed, 389 insertions(+), 69 deletions(-)