[PATCH 1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

[PATCH 1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

device_add shall not be called multiple times as stated in its
documentation:

 'Do not call this routine or device_register() more than once for
 any device structure'

Syzkaller reports a bug as follows [1]:
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:33!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[...]
Call Trace:
 <TASK>
 __list_add include/linux/list.h:69 [inline]
 list_add_tail include/linux/list.h:102 [inline]
 kobj_kset_join lib/kobject.c:164 [inline]
 kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
 kobject_add_varg lib/kobject.c:358 [inline]
 kobject_add+0x150/0x1c0 lib/kobject.c:410
 device_add+0x368/0x1e90 drivers/base/core.c:3452
 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
 hci_event_func net/bluetooth/hci_event.c:7440 [inline]
 hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/hci_sysfs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 4e3e0451b08c..08542dfc2dc5 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
 
 	BT_DBG("conn %p", conn);
 
+	if (device_is_registered(&conn->dev))
+		return;
+
 	dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
 	if (device_add(&conn->dev) < 0) {
-- 
2.37.3

[PATCH 2/2] Bluetooth: hci_debugfs: Fix not checking conn->debugfs

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

hci_debugfs_create_conn shall check if conn->debugfs has already been
created and don't attempt to overwrite it.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/hci_debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_debugfs.c b/net/bluetooth/hci_debugfs.c
index 902b40a90b91..3f401ec5bb0c 100644
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -1245,7 +1245,7 @@ void hci_debugfs_create_conn(struct hci_conn *conn)
 	struct hci_dev *hdev = conn->hdev;
 	char name[6];
 
-	if (IS_ERR_OR_NULL(hdev->debugfs))
+	if (IS_ERR_OR_NULL(hdev->debugfs) || conn->debugfs)
 		return;
 
 	snprintf(name, sizeof(name), "%u", conn->handle);
-- 
2.37.3

RE: [1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1466 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=678331

---Test result---

Test Summary:
CheckPatch                    PASS      3.63 seconds
GitLint                       FAIL      1.07 seconds
SubjectPrefix                 PASS      1.70 seconds
BuildKernel                   PASS      36.19 seconds
BuildKernel32                 PASS      31.49 seconds
Incremental Build with patchesPASS      50.95 seconds
TestRunner: Setup             PASS      509.27 seconds
TestRunner: l2cap-tester      PASS      17.28 seconds
TestRunner: iso-tester        PASS      16.25 seconds
TestRunner: bnep-tester       PASS      6.65 seconds
TestRunner: mgmt-tester       PASS      103.96 seconds
TestRunner: rfcomm-tester     PASS      10.30 seconds
TestRunner: sco-tester        PASS      9.75 seconds
TestRunner: smp-tester        PASS      9.83 seconds
TestRunner: userchan-tester   PASS      6.76 seconds

Details
##############################
Test: GitLint - FAIL - 1.07 seconds
Run gitlint with rule in .gitlint
[1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
37: B1 Line exceeds max length (83>80): "Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a"




---
Regards,
Linux Bluetooth

Re: [PATCH 1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

[Hawkins Jiawei]

> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> device_add shall not be called multiple times as stated in its
> documentation:
> 
>  'Do not call this routine or device_register() more than once for
>  any device structure'
> 
> Syzkaller reports a bug as follows [1]:
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:33!
> invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> [...]
> Call Trace:
>  <TASK>
>  __list_add include/linux/list.h:69 [inline]
>  list_add_tail include/linux/list.h:102 [inline]
>  kobj_kset_join lib/kobject.c:164 [inline]
>  kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
>  kobject_add_varg lib/kobject.c:358 [inline]
>  kobject_add+0x150/0x1c0 lib/kobject.c:410
>  device_add+0x368/0x1e90 drivers/base/core.c:3452
>  hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
>  hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
>  hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
>  hci_event_func net/bluetooth/hci_event.c:7440 [inline]
>  hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
>  hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
>  process_one_work+0x991/0x1610 kernel/workqueue.c:2289
>  worker_thread+0x665/0x1080 kernel/workqueue.c:2436
>  kthread+0x2e4/0x3a0 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
>  </TASK>
> 
> Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
I tried the reproducer from syzkaller, and it didn't trigger any issues.
And I also tryied multiple HCI_LE_CIS_Estabilished events, still normal.

Test-by: Hawkins Jiawei <yin31149@gmail.com>

> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  net/bluetooth/hci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
> index 4e3e0451b08c..08542dfc2dc5 100644
> --- a/net/bluetooth/hci_sysfs.c
> +++ b/net/bluetooth/hci_sysfs.c
> @@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
>  
>  	BT_DBG("conn %p", conn);
>  
> +	if (device_is_registered(&conn->dev))
> +		return;
> +
>  	dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
>  
>  	if (device_add(&conn->dev) < 0) {
> -- 
> 2.37.3

Re: [PATCH 1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

[patchwork-bot+bluetooth]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 19 Sep 2022 10:56:59 -0700 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> device_add shall not be called multiple times as stated in its
> documentation:
> 
>  'Do not call this routine or device_register() more than once for
>  any device structure'
> 
> [...]

Here is the summary with links:
  - [1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
    https://git.kernel.org/bluetooth/bluetooth-next/c/448a496f7606
  - [2/2] Bluetooth: hci_debugfs: Fix not checking conn->debugfs
    https://git.kernel.org/bluetooth/bluetooth-next/c/7096daba731e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html