From: Greg KH <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: torvalds@linux-foundation.org, akpm@linux-foundation.org,
alan@lxorguk.ukuu.org.uk, Johan Hovold <jhovold@gmail.com>,
Marcel Holtmann <marcel@holtmann.org>,
Johan Hedberg <johan.hedberg@intel.com>
Subject: [ 34/59] Bluetooth: hci_core: fix NULL-pointer dereference at unregister
Date: Thu, 19 Apr 2012 14:06:45 -0700 [thread overview]
Message-ID: <20120419210614.010139280@linuxfoundation.org> (raw)
In-Reply-To: <20120419210623.GA12156@kroah.com>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <jhovold@gmail.com>
commit 94324962066231a938564bebad0f941cd2d06bb2 upstream.
Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.
This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.
Bug is 100% reproducible using hciattach and a disconnected serial port:
0. # hciattach -n /dev/ttyO1 any noflow
1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...
[ 79.627136] INFO: trying to register non-static key.
[ 79.632354] the code is fine but needs lockdep annotation.
[ 79.638122] turning off the locking correctness validator.
[ 79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0)
[ 79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128)
[ 79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac)
[ 79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[ 79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[ 79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[ 79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[ 79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[ 79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[ 79.723358] 1fa0: 0001e6a0 be8dab00 0001e698 00036698
[ 79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ 79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[ 79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[ 79.756011] pgd = cf3b4000
[ 79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[ 79.765502] Internal error: Oops: 80000007 [#1]
[ 79.770294] Modules linked in:
[ 79.773529] CPU: 0 Tainted: G W (3.3.0-rc6-00002-gb5d5c87 #421)
[ 79.781066] PC is at 0x0
[ 79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[ 79.788787] pc : [<00000000>] lr : [<c0040aa4>] psr: 60000113
[ 79.788787] sp : cf281ee0 ip : 00000000 fp : cf280000
[ 79.800903] r10: 00000004 r9 : 00000100 r8 : b6f234d0
[ 79.806427] r7 : c0519c28 r6 : cf093488 r5 : c0561a00 r4 : 00000000
[ 79.813323] r3 : 00000000 r2 : c054eee0 r1 : 00000001 r0 : 00000000
[ 79.820190] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 79.827728] Control: 10c5387d Table: 8f3b4019 DAC: 00000015
[ 79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[ 79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[ 79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[ 79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[ 79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[ 79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[ 79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[ 79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[ 79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[ 79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ 79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[ 79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c)
[ 79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94)
[ 79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84)
[ 79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c)
[ 79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60)
[ 79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[ 79.973083] 1fa0: 0001e6a0 be8dab00 0001e698 00036698
[ 79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[ 79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[ 79.997161] Code: bad PC value
[ 80.000396] ---[ end trace 6f6739840475f9ee ]---
[ 80.005279] Kernel panic - not syncing: Fatal exception in interrupt
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/hci.h | 1 +
net/bluetooth/hci_core.c | 7 +++++++
2 files changed, 8 insertions(+)
--- a/include/net/bluetooth/hci.h
+++ b/include/net/bluetooth/hci.h
@@ -84,6 +84,7 @@ enum {
HCI_SERVICE_CACHE,
HCI_LINK_KEYS,
HCI_DEBUG_KEYS,
+ HCI_UNREGISTER,
HCI_RESET,
};
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -509,6 +509,11 @@ int hci_dev_open(__u16 dev)
hci_req_lock(hdev);
+ if (test_bit(HCI_UNREGISTER, &hdev->flags)) {
+ ret = -ENODEV;
+ goto done;
+ }
+
if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
ret = -ERFKILL;
goto done;
@@ -1317,6 +1322,8 @@ int hci_unregister_dev(struct hci_dev *h
BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
+ set_bit(HCI_UNREGISTER, &hdev->flags);
+
write_lock_bh(&hci_dev_list_lock);
list_del(&hdev->list);
write_unlock_bh(&hci_dev_list_lock);
next prev parent reply other threads:[~2012-04-19 21:13 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-04-19 21:06 [ 00/59] 3.0.29-stable review Greg KH
2012-04-19 21:06 ` [ 01/59] drm/i915/ringbuffer: Exclude last 2 cachlines of ring on 845g Greg KH
2012-04-19 21:06 ` [ 02/59] drm/radeon: only add the mm i2c bus if the hw_i2c module param is set Greg KH
2012-04-19 21:06 ` [ 03/59] rtlwifi: Add missing DMA buffer unmapping for PCI drivers Greg KH
2012-04-19 21:06 ` [ 04/59] ARM: 7384/1: ThumbEE: Disable userspace TEEHBR access for !CONFIG_ARM_THUMBEE Greg KH
2012-04-19 21:06 ` [ 05/59] [PATCH] Bluetooth: uart-ldisc: Fix memory leak Greg KH
2012-04-19 21:06 ` [ 06/59] Bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close Greg KH
2012-04-19 21:06 ` [ 07/59] ia64: fix futex_atomic_cmpxchg_inatomic() Greg KH
2012-04-19 21:06 ` [ 08/59] drivers/rtc/rtc-pl031.c: enable clock on all ST variants Greg KH
2012-04-19 21:06 ` [ 09/59] hugetlb: fix race condition in hugetlb_fault() Greg KH
2012-04-19 21:06 ` [ 10/59] staging: iio: hmc5843: Fix crash in probe function Greg KH
2012-04-19 21:06 ` [ 11/59] tty: serial: altera_uart: Check for NULL platform_data in probe Greg KH
2012-04-19 21:06 ` [ 12/59] sparc64: Eliminate obsolete __handle_softirq() function Greg KH
2012-04-19 21:06 ` [ 13/59] sparc64: Fix bootup crash on sun4v Greg KH
2012-04-19 21:06 ` [ 14/59] cciss: Initialize scsi host max_sectors for tape drive support Greg KH
2012-04-19 21:06 ` [ 15/59] cciss: Fix scsi tape io with more than 255 scatter gather elements Greg KH
2012-04-19 21:06 ` [ 16/59] perf hists: Catch and handle out-of-date hist entry maps Greg KH
2012-04-19 21:06 ` [ 17/59] video:uvesafb: Fix oops that uvesafb try to execute NX-protected page Greg KH
2012-04-19 21:06 ` [ 18/59] nohz: Fix stale jiffies update in tick_nohz_restart() Greg KH
2012-04-19 21:06 ` [ 19/59] USB: serial: fix race between probe and open Greg KH
2012-04-19 21:06 ` [ 20/59] USB: pl2303: fix DTR/RTS being raised on baud rate change Greg KH
2012-04-19 21:06 ` [ 21/59] USB: option: re-add NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED to option_id array Greg KH
2012-04-19 21:06 ` [ 22/59] USB: sierra: add support for Sierra Wireless MC7710 Greg KH
2012-04-19 21:06 ` [ 23/59] USB: dont clear urb->dev in scatter-gather library Greg KH
2012-04-19 21:06 ` [ 24/59] xhci: dont re-enable IE constantly Greg KH
2012-04-19 21:06 ` [ 25/59] xhci: Dont write zeroed pointers to xHC registers Greg KH
2012-04-19 21:06 ` [ 26/59] xhci: Restore event ring dequeue pointer on resume Greg KH
2012-04-19 21:06 ` [ 27/59] xHCI: Correct the #define XHCI_LEGACY_DISABLE_SMI Greg KH
2012-04-19 21:06 ` [ 28/59] xHCI: add XHCI_RESET_ON_RESUME quirk for VIA xHCI host Greg KH
2012-04-19 21:06 ` [ 29/59] serial: PL011: clear pending interrupts Greg KH
2012-04-19 21:06 ` [ 30/59] serial: PL011: move interrupt clearing Greg KH
2012-04-19 21:06 ` [ 31/59] fcaps: clear the same personality flags as suid when fcaps are used Greg KH
2012-04-19 21:06 ` [ 32/59] [PATCH] ath9k: fix max noise floor threshold Greg KH
2012-04-19 21:06 ` [ 33/59] xhci: Fix register save/restore order Greg KH
2012-04-19 21:06 ` Greg KH [this message]
2012-04-19 21:06 ` [ 35/59] pch_phub: Fix register miss-setting issue Greg KH
2012-04-19 21:06 ` [ 36/59] pch_phub: Care FUNCSEL register in PM Greg KH
2012-04-19 21:06 ` [ 37/59] pch_phub: Improve ADE(Address Decode Enable) control Greg KH
2012-04-19 21:06 ` [ 38/59] usb: gadget: pch_udc: Fix disconnect issue Greg KH
2012-04-19 21:06 ` [ 39/59] usb: gadget: pch_udc: Fix wrong return value Greg KH
2012-04-19 21:06 ` [ 40/59] usb: gadget: pch_udc: Fix USB suspend issue Greg KH
2012-04-19 21:06 ` [ 41/59] usb: gadget: pch_udc: Fix usb/gadget/pch_udc: Fix ether gadget connect/disconnect issue Greg KH
2012-04-19 21:06 ` [ 42/59] usb: gadget: pch_udc: Reduce redundant interrupt Greg KH
2012-04-19 21:06 ` [ 43/59] USB: pch_udc: Support new device LAPIS Semiconductor ML7831 IOH Greg KH
2012-04-19 21:06 ` [ 44/59] ACPICA: Fix to allow region arguments to reference other scopes Greg KH
2012-04-19 21:06 ` [ 45/59] security: fix compile error in commoncap.c Greg KH
2012-04-19 21:06 ` [ 46/59] pch_uart: Set PCIe bus number using probe parameter Greg KH
2012-04-19 21:06 ` [ 47/59] 8250_pci: Fix kernel panic when pch_uart is disabled Greg KH
2012-04-19 21:06 ` [ 48/59] pch_dma: fix DMA issue(ch8-ch11) Greg KH
2012-04-19 21:07 ` [ 49/59] pch_dma: Fix channel locking Greg KH
2012-04-19 21:07 ` [ 50/59] pch_dma: Fix CTL register access issue Greg KH
2012-04-19 21:07 ` [ 51/59] pch_dma: Fix suspend issue Greg KH
2012-04-19 21:07 ` [ 52/59] pch_dma: Support new device LAPIS Semiconductor ML7831 IOH Greg KH
2012-04-19 21:07 ` [ 53/59] md/bitmap: prevent bitmap_daemon_work running while initialising bitmap Greg KH
2012-04-19 21:07 ` [ 54/59] Bluetooth: Adding USB device 13d3:3375 as an Atheros AR3012 Greg KH
2012-04-19 21:07 ` [ 55/59] Bluetooth: Add Atheros maryann PIDVID support Greg KH
2012-04-19 21:07 ` [ 56/59] futex: Do not leak robust list to unprivileged process Greg KH
2012-04-19 21:07 ` [ 57/59] drm/radeon/kms: fix the regression of DVI connector check Greg KH
2012-04-19 21:07 ` [ 58/59] drm/radeon: disable MSI on RV515 Greg KH
2012-04-19 21:07 ` [ 59/59] drm/radeon: fix load detect on rn50 with hardcoded EDIDs Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120419210614.010139280@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=jhovold@gmail.com \
--cc=johan.hedberg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.