In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: Fix race condition during device registration<\/p>\n
In hci_register_dev(), the power_on work item is queued to
\nhdev->req_workqueue before initializing hdev->adv_monitors_idr and
\nregistering the MSFT extension via msft_register(). For devices marked with
\nquirks such as HCI_QUIRK_RAW_DEVICE, the HCI_UNCONFIGURED flag is set on
\nthe device. When the power_on work item runs concurrently on another CPU,
\nhci_power_on() detects that the device is unconfigured and immediately
\ninvokes hci_dev_do_close(), which calls msft_do_close().<\/p>\n
Concurrently, msft_register() allocates the msft structure and exposes it
\nto hdev->msft_data prior to calling mutex_init(&msft->filter_lock). If
\nmsft_do_close() executes while hdev->msft_data is already assigned but the
\nmutex has not yet been initialized, mutex_lock(&msft->filter_lock) operates
\non an uninitialized mutex, triggering a DEBUG_LOCKS warning:<\/p>\n
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
\nWARNING: kernel\/locking\/mutex.c:625 at __mutex_lock_common
\nkernel\/locking\/mutex.c:625 [inline]
\nWARNING: kernel\/locking\/mutex.c:625 at __mutex_lock+0x12d8\/0x1550
\nkernel\/locking\/mutex.c:821
\n…
\nCall Trace:<\/p>\n
msft_do_close+0x308\/0x7b0 net\/bluetooth\/msft.c:693
\n hci_dev_close_sync+0x86b\/0x10a0 net\/bluetooth\/hci_sync.c:5522
\n hci_dev_do_close net\/bluetooth\/hci_core.c:499 [inline]
\n hci_power_on+0x32c\/0x750 net\/bluetooth\/hci_core.c:937
\n process_one_work kernel\/workqueue.c:3322 [inline]
\n process_scheduled_works+0xa8e\/0x14e0 kernel\/workqueue.c:3405
\n worker_thread+0x92d\/0xe10 kernel\/workqueue.c:3486
\n kthread+0x388\/0x470 kernel\/kthread.c:436
\n ret_from_fork+0x514\/0xb70 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n
Fix this by moving the queue_work() call in hci_register_dev() to after
\nidr_init(&hdev->adv_monitors_idr) and msft_register(hdev) so that device
\nstructures and extensions are fully initialized before asynchronous tasks
\ncan access them. Additionally, assign hdev->msft_data in msft_register()
\nonly after mutex_init(&msft->filter_lock) has completed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_core: Fix race condition during device registration<\/p>\n
In hci_register_dev(), the power_on work item is queued to
\nhdev<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29263","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}