{"id":"DEBIAN-CVE-2021-47038","details":"In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: avoid deadlock between hci_dev-\u003elock and socket lock  Commit eab2404ba798 (\"Bluetooth: Add BT_PHY socket option\") added a dependency between socket lock and hci_dev-\u003elock that could lead to deadlock.  It turns out that hci_conn_get_phy() is not in any way relying on hdev being immutable during the runtime of this function, neither does it even look at any of the members of hdev, and as such there is no need to hold that lock.  This fixes the lockdep splat below:   ======================================================  WARNING: possible circular locking dependency detected  5.12.0-rc1-00026-g73d464503354 #10 Not tainted  ------------------------------------------------------  bluetoothd/1118 is trying to acquire lock:  ffff8f078383c078 (&hdev-\u003elock){+.+.}-{3:3}, at: hci_conn_get_phy+0x1c/0x150 [bluetooth]   but task is already holding lock:  ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: l2cap_sock_getsockopt+0x8b/0x610   which lock already depends on the new lock.   the existing dependency chain (in reverse order) is:   -\u003e #3 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}:         lock_sock_nested+0x72/0xa0         l2cap_sock_ready_cb+0x18/0x70 [bluetooth]         l2cap_config_rsp+0x27a/0x520 [bluetooth]         l2cap_sig_channel+0x658/0x1330 [bluetooth]         l2cap_recv_frame+0x1ba/0x310 [bluetooth]         hci_rx_work+0x1cc/0x640 [bluetooth]         process_one_work+0x244/0x5f0         worker_thread+0x3c/0x380         kthread+0x13e/0x160         ret_from_fork+0x22/0x30   -\u003e #2 (&chan-\u003elock#2/1){+.+.}-{3:3}:         __mutex_lock+0xa3/0xa10         l2cap_chan_connect+0x33a/0x940 [bluetooth]         l2cap_sock_connect+0x141/0x2a0 [bluetooth]         __sys_connect+0x9b/0xc0         __x64_sys_connect+0x16/0x20         do_syscall_64+0x33/0x80         entry_SYSCALL_64_after_hwframe+0x44/0xae   -\u003e #1 (&conn-\u003echan_lock){+.+.}-{3:3}:         __mutex_lock+0xa3/0xa10         l2cap_chan_connect+0x322/0x940 [bluetooth]         l2cap_sock_connect+0x141/0x2a0 [bluetooth]         __sys_connect+0x9b/0xc0         __x64_sys_connect+0x16/0x20         do_syscall_64+0x33/0x80         entry_SYSCALL_64_after_hwframe+0x44/0xae   -\u003e #0 (&hdev-\u003elock){+.+.}-{3:3}:         __lock_acquire+0x147a/0x1a50         lock_acquire+0x277/0x3d0         __mutex_lock+0xa3/0xa10         hci_conn_get_phy+0x1c/0x150 [bluetooth]         l2cap_sock_getsockopt+0x5a9/0x610 [bluetooth]         __sys_getsockopt+0xcc/0x200         __x64_sys_getsockopt+0x20/0x30         do_syscall_64+0x33/0x80         entry_SYSCALL_64_after_hwframe+0x44/0xae   other info that might help us debug this:   Chain exists of:    &hdev-\u003elock --\u003e &chan-\u003elock#2/1 --\u003e sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP    Possible unsafe locking scenario:          CPU0                    CPU1         ----                    ----    lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);                                 lock(&chan-\u003elock#2/1);                                 lock(sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP);    lock(&hdev-\u003elock);    *** DEADLOCK ***   1 lock held by bluetoothd/1118:   #0: ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0}, at: l2cap_sock_getsockopt+0x8b/0x610 [bluetooth]   stack backtrace:  CPU: 3 PID: 1118 Comm: bluetoothd Not tainted 5.12.0-rc1-00026-g73d464503354 #10  Hardware name: LENOVO 20K5S22R00/20K5S22R00, BIOS R0IET38W (1.16 ) 05/31/2017  Call Trace:   dump_stack+0x7f/0xa1   check_noncircular+0x105/0x120   ? __lock_acquire+0x147a/0x1a50   __lock_acquire+0x147a/0x1a50   lock_acquire+0x277/0x3d0   ? hci_conn_get_phy+0x1c/0x150 [bluetooth]   ? __lock_acquire+0x2e1/0x1a50   ? lock_is_held_type+0xb4/0x120   ? hci_conn_get_phy+0x1c/0x150 [bluetooth]   __mutex_lock+0xa3/0xa10   ? hci_conn_get_phy+0x1c/0x150 [bluetooth]   ? lock_acquire+0x277/0x3d0   ? mark_held_locks+0x49/0x70   ? mark_held_locks+0x49/0x70   ? hci_conn_get_phy+0x1c/0x150 [bluetooth]   hci_conn_get_phy+0x ---truncated---","modified":"2026-09-01T20:04:36.139859045Z","published":"2024-02-28T09:15:39.893Z","upstream":["CVE-2021-47038"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2021-47038"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.38-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47038.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.38-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47038.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.38-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2021-47038.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}