[PW_SID:1152930] Bluetooth: hci_core: Fix IRK lookup lifetime races

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  checks: write
+  pull-requests: write
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    name: CI for Pull Request
+    steps:
+    - name: Checkout the source code
+      uses: actions/checkout@v3
+      with:
+        path: src/src
+
+    - name: CI
+      uses: bluez/action-ci@main
+      with:
+        task: ci
+        base_folder: src
+        space: kernel
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+        email_token: ${{ secrets.EMAIL_TOKEN }}
+        patchwork_token: ${{ secrets.PATCHWORK_TOKEN }}
+        patchwork_user: ${{ secrets.PATCHWORK_USER }}
+

.github/workflows/sync.yml

@@ -0,0 +1,44 @@
+name: Sync
+
+on:
+  schedule:
+  - cron: "*/5 * * * *"
+
+jobs:
+  sync_repo:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        ref: master
+
+    - name: Sync Repo
+      uses: bluez/action-ci@main
+      with:
+        task: sync
+        workflow: workflow
+        upstream_repo: 'https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git'
+        github_token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Cleanup PR
+      uses: bluez/action-ci@main
+      with:
+        task: cleanup
+        github_token: ${{ secrets.ACTION_TOKEN }}
+
+  sync_patchwork:
+    needs: sync_repo
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Sync Patchwork
+      uses: bluez/action-ci@main
+      with:
+        task: patchwork
+        workflow: workflow
+        space: kernel
+        github_token: ${{ secrets.ACTION_TOKEN }}
+        email_token: ${{ secrets.EMAIL_TOKEN }}
+        patchwork_token: ${{ secrets.PATCHWORK_TOKEN }}
+        patchwork_user: ${{ secrets.PATCHWORK_USER }}

include/net/bluetooth/hci_core.h

@@ -24,6 +24,7 @@
 #define __HCI_CORE_H
 
 #include <linux/idr.h>
+#include <linux/kref.h>
 #include <linux/leds.h>
 #include <linux/rculist.h>
 #include <linux/spinlock.h>
@@ -211,6 +212,15 @@ struct smp_ltk {
 struct smp_irk {
 	struct list_head list;
 	struct rcu_head rcu;
+	struct kref ref;
+	unsigned long flags;
+	bdaddr_t rpa;
+	bdaddr_t bdaddr;
+	u8 addr_type;
+	u8 val[16];
+};
+
+struct smp_irk_data {
 	bdaddr_t rpa;
 	bdaddr_t bdaddr;
 	u8 addr_type;
@@ -561,6 +571,7 @@ struct hci_dev {
 	struct list_head	uuids;
 	struct list_head	link_keys;
 	struct list_head	long_term_keys;
+	spinlock_t		irk_lock; /* protects IRK list and data */
 	struct list_head	identity_resolving_keys;
 	struct list_head	remote_oob_data;
 	struct list_head	le_accept_list;
@@ -1929,11 +1940,16 @@ int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type);
 void hci_smp_ltks_clear(struct hci_dev *hdev);
 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr);
 
+/* Returned IRKs hold a reference that must be released with hci_irk_put(). */
 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa);
 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
 				     u8 addr_type);
 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
 			    u8 addr_type, u8 val[16], bdaddr_t *rpa);
+void hci_irk_read(struct hci_dev *hdev, struct smp_irk *irk,
+		  struct smp_irk_data *data);
+void hci_irk_put(struct smp_irk *irk);
+void hci_irk_unlink(struct hci_dev *hdev, struct smp_irk *irk);
 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type);
 bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16]);
 void hci_blocked_keys_clear(struct hci_dev *hdev);
@@ -2549,7 +2565,8 @@ void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr,
 		   u8 addr_type);
 bool mgmt_powering_down(struct hci_dev *hdev);
 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent);
-void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent);
+void mgmt_new_irk(struct hci_dev *hdev, const struct smp_irk_data *irk,
+		  bool persistent);
 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk,
 		   bool persistent);
 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr,

net/bluetooth/hci_conn.c

@@ -70,6 +70,8 @@ void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
 	struct hci_conn_params *params;
 	struct hci_dev *hdev = conn->hdev;
 	struct smp_irk *irk;
+	struct smp_irk_data irk_data;
+	bdaddr_t identity_addr;
 	bdaddr_t *bdaddr;
 	u8 bdaddr_type;
 
@@ -79,8 +81,11 @@ void hci_connect_le_scan_cleanup(struct hci_conn *conn, u8 status)
 	/* Check if we need to convert to identity address */
 	irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
 	if (irk) {
-		bdaddr = &irk->bdaddr;
-		bdaddr_type = irk->addr_type;
+		hci_irk_read(hdev, irk, &irk_data);
+		bacpy(&identity_addr, &irk_data.bdaddr);
+		bdaddr_type = irk_data.addr_type;
+		hci_irk_put(irk);
+		bdaddr = &identity_addr;
 	}
 
 	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, bdaddr,
@@ -1004,6 +1009,7 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
 {
 	struct hci_conn *conn;
 	struct smp_irk *irk = NULL;
+	struct smp_irk_data irk_data;
 
 	switch (type) {
 	case ACL_LINK:
@@ -1037,16 +1043,21 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type,
 	bt_dev_dbg(hdev, "dst %pMR handle 0x%4.4x", dst, handle);
 
 	conn = kzalloc_obj(*conn);
-	if (!conn)
+	if (!conn) {
+		if (irk)
+			hci_irk_put(irk);
 		return ERR_PTR(-ENOMEM);
+	}
 
 	/* If and IRK exists use its identity address */
 	if (!irk) {
 		bacpy(&conn->dst, dst);
 		conn->dst_type = dst_type;
 	} else {
-		bacpy(&conn->dst, &irk->bdaddr);
-		conn->dst_type = irk->addr_type;
+		hci_irk_read(hdev, irk, &irk_data);
+		bacpy(&conn->dst, &irk_data.bdaddr);
+		conn->dst_type = irk_data.addr_type;
+		hci_irk_put(irk);
 	}
 
 	bacpy(&conn->src, &hdev->bdaddr);
@@ -1458,6 +1469,8 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 {
 	struct hci_conn *conn;
 	struct smp_irk *irk;
+	struct smp_irk_data irk_data;
+	bdaddr_t rpa;
 	int err;
 
 	/* Let's make sure that le is enabled.*/
@@ -1498,9 +1511,14 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst,
 		 * from the connect request.
 		 */
 		irk = hci_find_irk_by_addr(hdev, dst, dst_type);
-		if (irk && bacmp(&irk->rpa, BDADDR_ANY)) {
-			dst = &irk->rpa;
-			dst_type = ADDR_LE_DEV_RANDOM;
+		if (irk) {
+			hci_irk_read(hdev, irk, &irk_data);
+			if (bacmp(&irk_data.rpa, BDADDR_ANY)) {
+				bacpy(&rpa, &irk_data.rpa);
+				dst = &rpa;
+				dst_type = ADDR_LE_DEV_RANDOM;
+			}
+			hci_irk_put(irk);
 		}
 	}