In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: don’t drain cmd_sync backlog on unregister<\/p>\n
hci_unregister_dev() disables cmd_work and cmd_timer, then calls
\nhci_cmd_sync_clear(), whose cancel_work_sync() waits for
\nhci_cmd_sync_work() to return. That worker dequeues and runs every
\nentry on cmd_sync_work_list. With cmd_work disabled nothing reaches
\nthe controller, so each queued HCI command waits the full
\nHCI_CMD_TIMEOUT (2s).<\/p>\n
The backlog has no bound. Userspace can keep queuing MGMT commands
\nsuch as MGMT_OP_GET_CLOCK_INFO against a controller that doesn’t
\nanswer. Closing \/dev\/vhci then blocks in vhci_release() for
\nbacklog * 2s:<\/p>\n
INFO: task syz-executor:5749 blocked for more than 143 seconds.
\n cancel_work_sync
\n hci_cmd_sync_clear
\n hci_unregister_dev
\n vhci_release<\/p>\n
In a local reproduction the backlog held more than 5000 entries,
\nwhich comes to hours of hang.<\/p>\n
Stop the worker from taking new entries once HCI_UNREGISTER is set,
\nand wake any request still waiting with -ENODEV before cancelling
\nthe work. The entries left over are destroyed with -ECANCELED by the
\nexisting sweep in hci_cmd_sync_clear(). They stay on the list until
\nthe work has stopped, so hci_cmd_sync_dequeue() and friends still see
\nthem. A callback already running may still issue another command,
\nwhich delays unregister by at most one timeout per remaining command,
\nnot by the whole backlog.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Bluetooth: hci_sync: don’t drain cmd_sync backlog on unregister<\/p>\n
hci_unregister_dev() disables cmd_work and cmd_timer, then calls
\nh<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41281","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}