In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: iso: Fix circular lock in isoconnbig_sync
This fixes the circular locking dependency warning below, by reworking isosockrecvmsg, to ensure that the socket lock is always released before calling a function that locks hdev.
[ 561.670344] ====================================================== [ 561.670346] WARNING: possible circular locking dependency detected [ 561.670349] 6.12.0-rc6+ #26 Not tainted [ 561.670351] ------------------------------------------------------ [ 561.670353] iso-tester/3289 is trying to acquire lock: [ 561.670355] ffff88811f600078 (&hdev->lock){+.+.}-{3:3}, at: isoconnbigsync+0x73/0x260 [bluetooth] [ 561.670405] but task is already holding lock: [ 561.670407] ffff88815af58258 (sklock-AFBLUETOOTH){+.+.}-{0:0}, at: isosock_recvmsg+0xbf/0x500 [bluetooth] [ 561.670450] which lock already depends on the new lock.
[ 561.670452] the existing dependency chain (in reverse order) is: [ 561.670453] -> #2 (sklock-AFBLUETOOTH){+.+.}-{0:0}: [ 561.670458] lockacquire+0x7c/0xc0 [ 561.670463] locksocknested+0x3b/0xf0 [ 561.670467] btacceptdequeue+0x1a5/0x4d0 [bluetooth] [ 561.670510] isosockaccept+0x271/0x830 [bluetooth] [ 561.670547] doaccept+0x3dd/0x610 [ 561.670550] _sysaccept4+0xd8/0x170 [ 561.670553] _x64sysaccept+0x74/0xc0 [ 561.670556] x64syscall+0x17d6/0x25f0 [ 561.670559] dosyscall64+0x87/0x150 [ 561.670563] entrySYSCALL64afterhwframe+0x76/0x7e [ 561.670567] -> #1 (sklock-AFBLUETOOTH-BTPROTOISO){+.+.}-{0:0}: [ 561.670571] lockacquire+0x7c/0xc0 [ 561.670574] locksocknested+0x3b/0xf0 [ 561.670577] isosocklisten+0x2de/0xf30 [bluetooth] [ 561.670617] _syslistensocket+0xef/0x130 [ 561.670620] _x64syslisten+0xe1/0x190 [ 561.670623] x64syscall+0x2517/0x25f0 [ 561.670626] dosyscall64+0x87/0x150 [ 561.670629] entrySYSCALL64afterhwframe+0x76/0x7e [ 561.670632] -> #0 (&hdev->lock){+.+.}-{3:3}: [ 561.670636] _lockacquire+0x32ad/0x6ab0 [ 561.670639] lockacquire.part.0+0x118/0x360 [ 561.670642] lockacquire+0x7c/0xc0 [ 561.670644] _mutexlock+0x18d/0x12f0 [ 561.670647] mutexlocknested+0x1b/0x30 [ 561.670651] isoconnbigsync+0x73/0x260 [bluetooth] [ 561.670687] isosockrecvmsg+0x3e9/0x500 [bluetooth] [ 561.670722] sockrecvmsg+0x1d5/0x240 [ 561.670725] sockreaditer+0x27d/0x470 [ 561.670727] vfsread+0x9a0/0xd30 [ 561.670731] ksysread+0x1a8/0x250 [ 561.670733] _x64sysread+0x72/0xc0 [ 561.670736] x64syscall+0x1b12/0x25f0 [ 561.670738] dosyscall64+0x87/0x150 [ 561.670741] entrySYSCALL64afterhwframe+0x76/0x7e [ 561.670744] other info that might help us debug this:
[ 561.670745] Chain exists of: &hdev->lock --> sklock-AFBLUETOOTH-BTPROTOISO --> sklock-AF_BLUETOOTH
[ 561.670751] Possible unsafe locking scenario:
[ 561.670753] CPU0 CPU1 [ 561.670754] ---- ---- [ 561.670756] lock(sklock-AFBLUETOOTH); [ 561.670758] lock(sklock AFBLUETOOTH-BTPROTOISO); [ 561.670761] lock(sklock-AF_BLUETOOTH); [ 561.670764] lock(&hdev->lock); [ 561.670767] * DEADLOCK *
[
{
"signature_type": "Line",
"id": "CVE-2024-54191-2ab944ad",
"target": {
"file": "net/bluetooth/iso.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"64609581633112065868260090984463019885",
"34145515026872275232434090667092891001",
"36432758548474185025212542410164625798",
"170328527208297941019787443536802709794",
"35337583437447978259652900608377530637",
"109095873783071267723053020533875638670",
"176940722314125391641652751043437162964",
"242917687595089842324034971331858110438",
"252883415821345271570125426561451395201",
"286683588519800972907215639802873504307",
"314472844862557205159525471615248734111",
"144045213286019524153949214481801123821",
"234045443966308946889872625253057493952",
"178003715430099944194014301390791832535",
"3602005525821013401889322367473388075",
"13238871840535162639822550510390343124",
"144081145210847110793684531480256789437",
"191327634607528034428435237060257751070",
"51013036673727386979933012168716870348",
"208184729862152597302572024466690400971",
"28519805178148478870720212373485781185",
"112054603627402808306600506010946849689",
"73337636781630977547824736183789352007",
"46892616387146253993713736162261309348",
"103634681122519562147939957001752507110",
"321885580526633564834547900351852778615",
"11444520637906171112226328576380001307",
"162019279116683419911522001111859745499",
"109632105637575631874221806910758636820",
"6978261165695831248143882206106046218",
"308141110218142220064492663306261838162",
"131600133813483781967898270362729205524",
"262516796050758727466433480241605232884",
"60421694636922203184876778434743968750",
"339936119541522100965110350737662312423",
"99571556469674434807518757199297785599",
"73210550285450838475366120709108458444",
"39412082879998677923952858970312074007",
"200648307420527283613850065057152151668",
"208145353247731408445727881260001539985",
"184808159078537233629708896176331373725"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5",
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2024-54191-54521aa9",
"target": {
"file": "net/bluetooth/iso.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"64609581633112065868260090984463019885",
"34145515026872275232434090667092891001",
"36432758548474185025212542410164625798",
"170328527208297941019787443536802709794",
"35337583437447978259652900608377530637",
"109095873783071267723053020533875638670",
"176940722314125391641652751043437162964",
"242917687595089842324034971331858110438",
"252883415821345271570125426561451395201",
"286683588519800972907215639802873504307",
"314472844862557205159525471615248734111",
"144045213286019524153949214481801123821",
"234045443966308946889872625253057493952",
"178003715430099944194014301390791832535",
"3602005525821013401889322367473388075",
"13238871840535162639822550510390343124",
"144081145210847110793684531480256789437",
"191327634607528034428435237060257751070",
"51013036673727386979933012168716870348",
"208184729862152597302572024466690400971",
"28519805178148478870720212373485781185",
"112054603627402808306600506010946849689",
"73337636781630977547824736183789352007",
"46892616387146253993713736162261309348",
"103634681122519562147939957001752507110",
"321885580526633564834547900351852778615",
"11444520637906171112226328576380001307",
"162019279116683419911522001111859745499",
"109632105637575631874221806910758636820",
"6978261165695831248143882206106046218",
"308141110218142220064492663306261838162",
"131600133813483781967898270362729205524",
"262516796050758727466433480241605232884",
"60421694636922203184876778434743968750",
"339936119541522100965110350737662312423",
"99571556469674434807518757199297785599",
"73210550285450838475366120709108458444",
"39412082879998677923952858970312074007",
"200648307420527283613850065057152151668",
"208145353247731408445727881260001539985",
"184808159078537233629708896176331373725"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a17308c17880d259105f6e591eb1bc77b9612f0",
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-54191-5f9300df",
"target": {
"function": "iso_conn_big_sync",
"file": "net/bluetooth/iso.c"
},
"digest": {
"function_hash": "293908585269806328750455637402945981108",
"length": 575.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a17308c17880d259105f6e591eb1bc77b9612f0",
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-54191-76567179",
"target": {
"function": "iso_sock_recvmsg",
"file": "net/bluetooth/iso.c"
},
"digest": {
"function_hash": "245381125165977261373833224207196914219",
"length": 873.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5",
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-54191-9931f366",
"target": {
"function": "iso_sock_recvmsg",
"file": "net/bluetooth/iso.c"
},
"digest": {
"function_hash": "245381125165977261373833224207196914219",
"length": 873.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a17308c17880d259105f6e591eb1bc77b9612f0",
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2024-54191-e761416e",
"target": {
"function": "iso_conn_big_sync",
"file": "net/bluetooth/iso.c"
},
"digest": {
"function_hash": "293908585269806328750455637402945981108",
"length": 575.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbe640d6cae590b9a7d81ce86fe9a90e83eec1d5",
"deprecated": false
}
]