From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ying Hsu <yinghsu@chromium.org>,
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
Sasha Levin <sashal@kernel.org>,
marcel@holtmann.org, johan.hedberg@gmail.com,
luiz.dentz@gmail.com, linux-bluetooth@vger.kernel.org
Subject: [PATCH AUTOSEL 6.1 14/26] Bluetooth: Fix hci_suspend_sync crash
Date: Fri, 8 Sep 2023 14:17:52 -0400 [thread overview]
Message-ID: <20230908181806.3460164-14-sashal@kernel.org> (raw)
In-Reply-To: <20230908181806.3460164-1-sashal@kernel.org>
From: Ying Hsu <yinghsu@chromium.org>
[ Upstream commit 573ebae162111063eedc6c838a659ba628f66a0f ]
If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier
may still be accessing it, it can cause the program to crash.
Here's the call trace:
<4>[102152.653246] Call Trace:
<4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth]
<4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth]
<4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth]
<4>[102152.653268] notifier_call_chain+0x43/0x6b
<4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69
<4>[102152.653273] __pm_notifier_call_chain+0x22/0x39
<4>[102152.653276] pm_suspend+0x287/0x57c
<4>[102152.653278] state_store+0xae/0xe5
<4>[102152.653281] kernfs_fop_write+0x109/0x173
<4>[102152.653284] __vfs_write+0x16f/0x1a2
<4>[102152.653287] ? selinux_file_permission+0xca/0x16f
<4>[102152.653289] ? security_file_permission+0x36/0x109
<4>[102152.653291] vfs_write+0x114/0x21d
<4>[102152.653293] __x64_sys_write+0x7b/0xdb
<4>[102152.653296] do_syscall_64+0x59/0x194
<4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
This patch holds the reference count of the hci_dev object while
processing it in hci_suspend_notifier to avoid potential crash
caused by the race condition.
Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d034bf2a999e1..146ad00ad1b9c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2436,6 +2436,9 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
return NOTIFY_DONE;
+ /* To avoid a potential race with hci_unregister_dev. */
+ hci_dev_hold(hdev);
+
if (action == PM_SUSPEND_PREPARE)
ret = hci_suspend_dev(hdev);
else if (action == PM_POST_SUSPEND)
@@ -2445,6 +2448,7 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
action, ret);
+ hci_dev_put(hdev);
return NOTIFY_DONE;
}
--
2.40.1
next prev parent reply other threads:[~2023-09-08 18:22 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-08 18:17 [PATCH AUTOSEL 6.1 01/26] devlink: remove reload failed checks in params get/set callbacks Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 02/26] crypto: lrw,xts - Replace strlcpy with strscpy Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 03/26] ice: Don't tx before switchdev is fully configured Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 04/26] wifi: ath9k: fix fortify warnings Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 05/26] wifi: ath9k: fix printk specifier Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 06/26] wifi: mwifiex: fix fortify warning Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 07/26] mt76: mt7921: don't assume adequate headroom for SDIO headers Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 08/26] wifi: wil6210: fix fortify warnings Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 09/26] can: sun4i_can: Add acceptance register quirk Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 10/26] can: sun4i_can: Add support for the Allwinner D1 Sasha Levin
2023-09-11 9:47 ` Pavel Machek
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 11/26] net: Use sockaddr_storage for getsockopt(SO_PEERNAME) Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 12/26] net/ipv4: return the real errno instead of -EINVAL Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 13/26] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Sasha Levin
2023-09-08 18:17 ` Sasha Levin [this message]
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 15/26] netlink: convert nlk->flags to atomic flags Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 16/26] tpm_tis: Resend command to recover from data transfer errors Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 17/26] mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450 Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 18/26] alx: fix OOB-read compiler warning Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 19/26] wifi: mac80211: check S1G action frame size Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 20/26] netfilter: ebtables: fix fortify warnings in size_entry_mwt() Sasha Levin
2023-09-08 18:17 ` [PATCH AUTOSEL 6.1 21/26] wifi: cfg80211: reject auth/assoc to AP with our address Sasha Levin
2023-09-08 18:18 ` [PATCH AUTOSEL 6.1 22/26] wifi: cfg80211: ocb: don't leave if not joined Sasha Levin
2023-09-08 18:18 ` [PATCH AUTOSEL 6.1 23/26] wifi: mac80211: check for station first in client probe Sasha Levin
2023-09-08 18:18 ` [PATCH AUTOSEL 6.1 24/26] wifi: mac80211_hwsim: drop short frames Sasha Levin
2023-09-08 18:18 ` [PATCH AUTOSEL 6.1 25/26] libbpf: Free btf_vmlinux when closing bpf_object Sasha Levin
2023-09-08 18:18 ` [PATCH AUTOSEL 6.1 26/26] Bluetooth: btusb: Fix quirks table naming Sasha Levin
2023-09-08 21:44 ` [PATCH AUTOSEL 6.1 01/26] devlink: remove reload failed checks in params get/set callbacks Jacob Keller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230908181806.3460164-14-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=johan.hedberg@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=luiz.von.dentz@intel.com \
--cc=marcel@holtmann.org \
--cc=stable@vger.kernel.org \
--cc=yinghsu@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox