CVE-2024-54460: Bluetooth: iso: Fix circular lock in iso_listen_bis

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: iso: Fix circular lock in isolistenbis

This fixes the circular locking dependency warning below, by releasing the socket lock before enterning isolistenbis, to avoid any potential deadlock with hdev lock.

[ 75.307983] ====================================================== [ 75.307984] WARNING: possible circular locking dependency detected [ 75.307985] 6.12.0-rc6+ #22 Not tainted [ 75.307987] ------------------------------------------------------ [ 75.307987] kworker/u81:2/2623 is trying to acquire lock: [ 75.307988] ffff8fde1769da58 (sklock-AFBLUETOOTH-BTPROTOISO) at: isoconnectcfm+0x253/0x840 [bluetooth] [ 75.308021] but task is already holding lock: [ 75.308022] ffff8fdd61a10078 (&hdev->lock) at: hcileperadvreportevt+0x47/0x2f0 [bluetooth] [ 75.308053] which lock already depends on the new lock.

[ 75.308054] the existing dependency chain (in reverse order) is: [ 75.308055] -> #1 (&hdev->lock){+.+.}-{3:3}: [ 75.308057] mutexlock+0xad/0xc50 [ 75.308061] mutexlocknested+0x1b/0x30 [ 75.308063] isosocklisten+0x143/0x5c0 [bluetooth] [ 75.308085] syslistensocket+0x49/0x60 [ 75.308088] x64syslisten+0x4c/0x90 [ 75.308090] x64syscall+0x2517/0x25f0 [ 75.308092] dosyscall64+0x87/0x150 [ 75.308095] entrySYSCALL64afterhwframe+0x76/0x7e [ 75.308098] -> #0 (sklock-AFBLUETOOTH-BTPROTOISO){+.+.}-{0:0}: [ 75.308100] lockacquire+0x155e/0x25f0 [ 75.308103] lockacquire+0xc9/0x300 [ 75.308105] locksocknested+0x32/0x90 [ 75.308107] isoconnectcfm+0x253/0x840 [bluetooth] [ 75.308128] hciconnectcfm+0x6c/0x190 [bluetooth] [ 75.308155] hcileperadvreportevt+0x27b/0x2f0 [bluetooth] [ 75.308180] hcilemetaevt+0xe7/0x200 [bluetooth] [ 75.308206] hcieventpacket+0x21f/0x5c0 [bluetooth] [ 75.308230] hcirxwork+0x3ae/0xb10 [bluetooth] [ 75.308254] processonework+0x212/0x740 [ 75.308256] workerthread+0x1bd/0x3a0 [ 75.308258] kthread+0xe4/0x120 [ 75.308259] retfromfork+0x44/0x70 [ 75.308261] retfromforkasm+0x1a/0x30 [ 75.308263] other info that might help us debug this:

[ 75.308264] Possible unsafe locking scenario:

[ 75.308264] CPU0 CPU1 [ 75.308265] ---- ---- [ 75.308265] lock(&hdev->lock); [ 75.308267] lock(sklock- AFBLUETOOTH-BTPROTOISO); [ 75.308268] lock(&hdev->lock); [ 75.308269] lock(sklock-AFBLUETOOTH-BTPROTOISO); [ 75.308270] DEADLOCK

[ 75.308271] 4 locks held by kworker/u81:2/2623: [ 75.308272] #0: ffff8fdd66e52148 ((wqcompletion)hci0#2){+.+.}-{0:0}, at: processonework+0x443/0x740 [ 75.308276] #1: ffffafb488b7fe48 ((workcompletion)(&hdev->rxwork)), at: processonework+0x1ce/0x740 [ 75.308280] #2: ffff8fdd61a10078 (&hdev->lock){+.+.}-{3:3} at: hcileperadvreportevt+0x47/0x2f0 [bluetooth] [ 75.308304] #3: ffffffffb6ba4900 (rcureadlock){....}-{1:2}, at: hciconnectcfm+0x29/0x190 [bluetooth]

— NVD

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad