Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup rfcomm_sock_cleanup_listen() closes unaccepted child sockets through rfcomm_sock_close(), which takes the child socket lock before rfcomm_dlc_close() acquires rfcomm_mutex. The RFCOMM worker takes these locks in reverse order while handling connections and DLC state changes, so lockdep reports a possible deadlock. Close dequeued children without taking their socket lock. The accept queue owns a reference to each child, and bt_accept_dequeue() locks the child while unlinking it and clearing its parent pointer. Dropping the child lock makes it important to prevent a concurrent rfcomm_connect_ind() from enqueueing a new child after cleanup observes an empty queue. Set a listening socket to BT_CLOSED while its lock is still held, before dropping the lock and draining the queue. The state check in rfcomm_connect_ind() then rejects new children once cleanup starts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b7ce436a5d798bc59e71797952566608a4b4626b to < eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57caffectedb7ce436a5d798bc59e71797952566608a4b4626b to < 4aafb47301a799d3e01230d6568c4e93524e1523affectedb7ce436a5d798bc59e71797952566608a4b4626b to < c741977e413f5b49d306700820fb55ccb8269f5aaffectedb7ce436a5d798bc59e71797952566608a4b4626b to < c6792c441767256030606eb82dca5d5fc360dd9aaffectedb7ce436a5d798bc59e71797952566608a4b4626b to < bfce253f039eb5f58b810af267942a9f59207254affectedb7ce436a5d798bc59e71797952566608a4b4626b to < 18174b166547ef41973cc19feb5ef9cab39a8defaffectedb7ce436a5d798bc59e71797952566608a4b4626b to < 801fb950cae7048eb7d83b18857d1ca37b8cd5a4affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eb4adaa46e4c9e6efa7be3ce06398f4d7c39b57c ↗
- https://git.kernel.org/stable/c/4aafb47301a799d3e01230d6568c4e93524e1523 ↗
- https://git.kernel.org/stable/c/c741977e413f5b49d306700820fb55ccb8269f5a ↗
- https://git.kernel.org/stable/c/c6792c441767256030606eb82dca5d5fc360dd9a ↗
- https://git.kernel.org/stable/c/bfce253f039eb5f58b810af267942a9f59207254 ↗
- https://git.kernel.org/stable/c/18174b166547ef41973cc19feb5ef9cab39a8def ↗
- https://git.kernel.org/stable/c/801fb950cae7048eb7d83b18857d1ca37b8cd5a4 ↗