[PATCH] Bluetooth: coredump: Don't leak an active dump when the device is opened

[PATCH] Bluetooth: coredump: Don't leak an active dump when the device is opened

[Ali Ahmet Memiş]

If the device is closed during a dump and opened again before the dump
timeout fires, hci_devcd_reset() in hci_dev_open_sync() clears
dump.head and cancels the timeout without freeing the buffer, so it is
leaked.

Free it instead after making sure the timeout is not running.

Fixes: 9695ef876fd1 ("Bluetooth: Add support for hci devcoredump")
Signed-off-by: Ali Ahmet Memiş <aliamemis@disroot.org>
---
On top of 860b93123309 ("Bluetooth: hci_sync: Serialize devcoredump
reset during device open")

Tested with hci_vhci.  force_devcoredump in TIMEOUT state, then
"hciconfig hci0 up" before the timeout.  Without the patch the buffer
stays in /proc/vmallocinfo, with it it is freed.

 include/net/bluetooth/coredump.h | 2 ++
 net/bluetooth/coredump.c         | 9 +++++++++
 net/bluetooth/hci_sync.c         | 4 +---
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/include/net/bluetooth/coredump.h b/include/net/bluetooth/coredump.h
index acc1849f6..b8bba9a8b 100644
--- a/include/net/bluetooth/coredump.h
+++ b/include/net/bluetooth/coredump.h
@@ -70,6 +70,7 @@ struct hci_devcoredump {
 const char *hci_devcd_state_name(enum devcoredump_state state);
 
 void hci_devcd_reset(struct hci_dev *hdev);
+void hci_devcd_discard(struct hci_dev *hdev);
 void hci_devcd_shutdown(struct hci_dev *hdev);
 void hci_devcd_rx(struct work_struct *work);
 void hci_devcd_timeout(struct work_struct *work);
@@ -90,6 +91,7 @@ static inline const char *hci_devcd_state_name(enum devcoredump_state state)
 }
 
 static inline void hci_devcd_reset(struct hci_dev *hdev) {}
+static inline void hci_devcd_discard(struct hci_dev *hdev) {}
 static inline void hci_devcd_shutdown(struct hci_dev *hdev) {}
 static inline void hci_devcd_rx(struct work_struct *work) {}
 static inline void hci_devcd_timeout(struct work_struct *work) {}
diff --git a/net/bluetooth/coredump.c b/net/bluetooth/coredump.c
index 71fc8dab4..b4283e6ae 100644
--- a/net/bluetooth/coredump.c
+++ b/net/bluetooth/coredump.c
@@ -104,6 +104,15 @@ static void hci_devcd_free(struct hci_dev *hdev)
 	hci_devcd_reset(hdev);
 }
 
+void hci_devcd_discard(struct hci_dev *hdev)
+{
+	cancel_delayed_work_sync(&hdev->dump.dump_timeout);
+
+	hci_dev_lock(hdev);
+	hci_devcd_free(hdev);
+	hci_dev_unlock(hdev);
+}
+
 void hci_devcd_shutdown(struct hci_dev *hdev)
 {
 	unsigned long flags;
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index efbd2e538..cc2f81b62 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5503,9 +5503,7 @@ int hci_dev_open_sync(struct hci_dev *hdev)
 		goto done;
 	}
 
-	hci_dev_lock(hdev);
-	hci_devcd_reset(hdev);
-	hci_dev_unlock(hdev);
+	hci_devcd_discard(hdev);
 
 	set_bit(HCI_RUNNING, &hdev->flags);
 	hci_sock_dev_event(hdev, HCI_DEV_OPEN);
-- 
2.55.0

RE: Bluetooth: coredump: Don't leak an active dump when the device is opened

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1606 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1183097/

---Test result---

Test Summary:
CheckPatch                    PASS      1.06 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.24 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      30.46 seconds
CheckAllWarning               PASS      34.16 seconds
CheckSparse                   PASS      36.86 seconds
BuildKernel32                 PASS      30.18 seconds
CheckKernelLLVM               PASS      33.76 seconds
TestRunnerSetup               PASS      800.12 seconds
TestRunner_l2cap-tester       PASS      13.01 seconds
TestRunner_iso-tester         PASS      10.89 seconds
TestRunner_bnep-tester        PASS      3.12 seconds
TestRunner_mgmt-tester        PASS      61.52 seconds
TestRunner_rfcomm-tester      PASS      4.44 seconds
TestRunner_sco-tester         PASS      5.60 seconds
TestRunner_ioctl-tester       PASS      4.65 seconds
TestRunner_mesh-tester        PASS      5.51 seconds
TestRunner_smp-tester         PASS      4.33 seconds
TestRunner_userchan-tester    PASS      10.70 seconds
TestRunner_6lowpan-tester     PASS      4.40 seconds
IncrementalBuild              PASS      31.52 seconds



https://github.com/bluez/bluetooth-next/pull/895

---
Regards,
Linux Bluetooth