From: bgodavar@codeaurora.org
To: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
Cc: marcel@holtmann.org, johan.hedberg@gmail.com, mka@chromium.org,
linux-kernel@vger.kernel.org, linux-bluetooth@vger.kernel.org,
robh@kernel.org, hemantg@codeaurora.org,
linux-arm-msm@vger.kernel.org, tientzu@chromium.org,
seanpaul@chromium.org, rjliao@codeaurora.org, yshavit@google.com,
abhishekpandit@chromium.org
Subject: Re: [PATCH v1] Bluetooth: hci_qca: Fix double free during SSR timeout
Date: Thu, 04 Jun 2020 21:17:36 +0530 [thread overview]
Message-ID: <9baddcafef3c1ecad1f968e3adaf3201@codeaurora.org> (raw)
In-Reply-To: <1591279032-7527-1-git-send-email-gubbaven@codeaurora.org>
On 2020-06-04 19:27, Venkata Lakshmi Narayana Gubba wrote:
> Due to race conditions between qca_hw_error and qca_controller_memdump
> during SSR timeout,the same pointer is freed twice. Which results to
> double free error. Now a lock is acquired while SSR state moved to
> timeout.
>
> Signed-off-by: Venkata Lakshmi Narayana Gubba <gubbaven@codeaurora.org>
> ---
> drivers/bluetooth/hci_qca.c | 19 ++++++++++++++-----
> 1 file changed, 14 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
> index 836949d..9110775 100644
> --- a/drivers/bluetooth/hci_qca.c
> +++ b/drivers/bluetooth/hci_qca.c
> @@ -983,8 +983,11 @@ static void qca_controller_memdump(struct
> work_struct *work)
> while ((skb = skb_dequeue(&qca->rx_memdump_q))) {
>
> mutex_lock(&qca->hci_memdump_lock);
> - /* Skip processing the received packets if timeout detected. */
> - if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT) {
> + /* Skip processing the received packets if timeout detected
> + * or memdump collection completed.
> + */
> + if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
> + qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
> mutex_unlock(&qca->hci_memdump_lock);
> return;
> }
> @@ -1485,7 +1488,7 @@ static void qca_hw_error(struct hci_dev *hdev, u8
> code)
> {
> struct hci_uart *hu = hci_get_drvdata(hdev);
> struct qca_data *qca = hu->priv;
> - struct qca_memdump_data *qca_memdump = qca->qca_memdump;
> + struct qca_memdump_data *qca_memdump = NULL;
> char *memdump_buf = NULL;
>
> set_bit(QCA_HW_ERROR_EVENT, &qca->flags);
> @@ -1509,9 +1512,10 @@ static void qca_hw_error(struct hci_dev *hdev,
> u8 code)
> qca_wait_for_dump_collection(hdev);
> }
>
> + mutex_lock(&qca->hci_memdump_lock);
> if (qca->memdump_state != QCA_MEMDUMP_COLLECTED) {
> bt_dev_err(hu->hdev, "clearing allocated memory due to memdump
> timeout");
> - mutex_lock(&qca->hci_memdump_lock);
> + qca_memdump = qca->qca_memdump;
> if (qca_memdump)
> memdump_buf = qca_memdump->memdump_buf_head;
> vfree(memdump_buf);
> @@ -1520,8 +1524,13 @@ static void qca_hw_error(struct hci_dev *hdev,
> u8 code)
> qca->memdump_state = QCA_MEMDUMP_TIMEOUT;
> cancel_delayed_work(&qca->ctrl_memdump_timeout);
> skb_queue_purge(&qca->rx_memdump_q);
> - mutex_unlock(&qca->hci_memdump_lock);
> + }
> + mutex_unlock(&qca->hci_memdump_lock);
> +
> + if (qca->memdump_state == QCA_MEMDUMP_TIMEOUT ||
> + qca->memdump_state == QCA_MEMDUMP_COLLECTED) {
> cancel_work_sync(&qca->ctrl_memdump_evt);
> + skb_queue_purge(&qca->rx_memdump_q);
> }
>
> clear_bit(QCA_HW_ERROR_EVENT, &qca->flags);
Reviewed-by: Balakrishna Godavarthi <bgodavar@codeaurora.org>
next prev parent reply other threads:[~2020-06-04 15:47 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-04 13:57 [PATCH v1] Bluetooth: hci_qca: Fix double free during SSR timeout Venkata Lakshmi Narayana Gubba
2020-06-04 15:47 ` bgodavar [this message]
2020-06-05 4:53 ` Abhishek Pandit-Subedi
2020-06-09 15:55 ` gubbaven
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9baddcafef3c1ecad1f968e3adaf3201@codeaurora.org \
--to=bgodavar@codeaurora.org \
--cc=abhishekpandit@chromium.org \
--cc=gubbaven@codeaurora.org \
--cc=hemantg@codeaurora.org \
--cc=johan.hedberg@gmail.com \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=mka@chromium.org \
--cc=rjliao@codeaurora.org \
--cc=robh@kernel.org \
--cc=seanpaul@chromium.org \
--cc=tientzu@chromium.org \
--cc=yshavit@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.