CVE-2024-57894: Bluetooth: hci_core: Fix sleeping function called from invalid context
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hcicore: Fix sleeping function called from invalid context
This reworks hcicblist to not use mutex hcicblistlock to avoid bugs like the bellow:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585 inatomic(): 0, irqsdisabled(): 0, nonblock: 0, pid: 5070, name: kworker/u9:2 preemptcount: 0, expected: 0 RCU nest depth: 1, expected: 0 4 locks held by kworker/u9:2/5070: #0: ffff888015be3948 ((wqcompletion)hci0#2){+.+.}-{0:0}, at: processonework kernel/workqueue.c:3229 [inline] #0: ffff888015be3948 ((wqcompletion)hci0#2){+.+.}-{0:0}, at: processscheduledworks+0x8e0/0x1770 kernel/workqueue.c:3335 #1: ffffc90003b6fd00 ((workcompletion)(&hdev->rxwork)){+.+.}-{0:0}, at: processonework kernel/workqueue.c:3230 [inline] #1: ffffc90003b6fd00 ((workcompletion)(&hdev->rxwork)){+.+.}-{0:0}, at: processscheduledworks+0x91b/0x1770 kernel/workqueue.c:3335 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hcilecreatebigcompleteevt+0xcf/0xae0 net/bluetooth/hcievent.c:6914 #3: ffffffff8e132020 (rcureadlock){....}-{1:2}, at: rculockacquire include/linux/rcupdate.h:298 [inline] #3: ffffffff8e132020 (rcureadlock){....}-{1:2}, at: rcureadlock include/linux/rcupdate.h:750 [inline] #3: ffffffff8e132020 (rcureadlock){....}-{1:2}, at: hcilecreatebigcompleteevt+0xdb/0xae0 net/bluetooth/hcievent.c:6915 CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: hci0 hcirxwork Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:114 mightresched+0x5d4/0x780 kernel/sched/core.c:10187 mutexlockcommon kernel/locking/mutex.c:585 [inline] mutexlock+0xc1/0xd70 kernel/locking/mutex.c:752 hciconnectcfm include/net/bluetooth/hcicore.h:2004 [inline] hcilecreatebigcompleteevt+0x3d9/0xae0 net/bluetooth/hcievent.c:6939 hcieventfunc net/bluetooth/hcievent.c:7514 [inline] hcieventpacket+0xa53/0x1540 net/bluetooth/hcievent.c:7569 hcirxwork+0x3e8/0xca0 net/bluetooth/hcicore.c:4171 processonework kernel/workqueue.c:3254 [inline] processscheduledworks+0xa00/0x1770 kernel/workqueue.c:3335 workerthread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:243 </TASK>
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57894?
CVE-2024-57894 has been classified as a vulnerability that can lead to system instability due to improper handling of sleeping functions in the Linux kernel.
How do I fix CVE-2024-57894?
To fix CVE-2024-57894, update your Linux kernel to the patched version that addresses this specific issue.
Which versions of Linux Kernel are affected by CVE-2024-57894?
CVE-2024-57894 affects various versions of the Linux Kernel that utilize the Bluetooth subsystem and have not applied the necessary patches.
What symptoms indicate the presence of CVE-2024-57894?
Symptoms may include unexpected system behavior or crashes, particularly when using Bluetooth functionality in the affected Linux Kernel versions.
Is CVE-2024-57894 related to Bluetooth functionality?
Yes, CVE-2024-57894 specifically involves a vulnerability within the Bluetooth subsystem of the Linux kernel.