CVE-2024-41063 Information

Jul 31, 2024 cve

Description

In the Linux kernel the following vulnerability has been resolved:

Bluetooth: hci_core: cancel all works upon hci_unregister_dev()

syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause deadlock at destroy_workqueue() for hci_error_reset() is called from hdev->req_workqueue which destroy_workqueue() needs to flush.

We need to make sure that hdev->rx_workcmd_worktx_work which are queued into hdev->workqueue and hdev->power_onerror_reset which are queued into hdev->req_workqueue are no longer running by the moment

   destroy_workqueue(hdev->workqueue);
   destroy_workqueue(hdev->req_workqueue);

are called from hci_release_dev().

Call cancel_work_sync() on these work items from hci_unregister_dev() as soon as hdev->list is removed from hci_dev_list.

Reference

Share on: