Bluetooth: RFCOMM: serialize session teardown

rfcomm_kill_listener() walks session_list and deletes every session
without holding rfcomm_mutex, unlike the normal session processing and
connect error paths.

Under normal operation, an open RFCOMM socket pins rfcomm.ko, so
rfcomm_kill_listener() does not run concurrently with rfcomm_dlc_open().
However, forced module unload via delete_module(O_TRUNC) can stop
krfcommd while a failed connect is still unwinding.

  connect task                    forced unload / krfcommd
  ------------                    ------------------------
  rfcomm_lock()
  rfcomm_session_add()
                                  delete_module("rfcomm", O_TRUNC)
                                  rfcomm_kill_listener()
                                    fetch session from session_list
  kernel_connect() fails
  rfcomm_session_del()
    remove and free session
                                  rfcomm_session_del(session)

The final call then reads the freed session and may corrupt the list.

KASAN reported with mdelay() to enlarge critical window:

  BUG: KASAN: slab-use-after-free in rfcomm_run+0x3802/0x3f00 [rfcomm]
  Read of size 8 at addr ffff888111058d40 by task krfcommd/79
  Tainted: [R]=FORCED_RMMOD
  Allocated by task 86:
   rfcomm_session_add+0xa1/0x300 [rfcomm]
   rfcomm_dlc_open+0x8b2/0xf30 [rfcomm]
   rfcomm_sock_connect+0x34c/0x530 [rfcomm]
  Freed by task 86:
   kfree+0x121/0x3c0
   rfcomm_dlc_open+0xab7/0xf30 [rfcomm]
   rfcomm_sock_connect+0x34c/0x530 [rfcomm]

Hold rfcomm_mutex across the teardown traversal so every reachable
session_list walk uses the same serialization.

Reviewed-by: Ali Ahmet Memis <ali@iusegentoo.com>
Tested-by: Ali Ahmet Memis <ali@iusegentoo.com>
Reviewed-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

0 files changed, 0 insertions, 0 deletions