* net, bluetooth: object debug warning in bt_host_release()
@ 2012-11-13 16:18 Sasha Levin
[not found] ` <50A272E7.9080103-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
0 siblings, 1 reply; 2+ messages in thread
From: Sasha Levin @ 2012-11-13 16:18 UTC (permalink / raw)
To: marcel, gustavo, Johan Hedberg, David S. Miller
Cc: linux-bluetooth, netdev, linux-kernel@vger.kernel.org, Dave Jones
Hi all,
While fuzzing with trinity on a KVM tools (lkvm) guest running latest -next kernel I've
stumbled on the following:
[ 1434.201149] ------------[ cut here ]------------
[ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
[ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci_power_on+0x0/0x90
[ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-next-20121112-sasha-00018-g2f4ce0e #127
[ 1434.210760] Call Trace:
[ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
[ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
[ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
[ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
[ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
[ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
[ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330
[ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0
[ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
[ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10
[ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60
[ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20
[ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30
[ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
[ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250
[ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
[ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10
[ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0
[ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
[ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17
[ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---
Not that the guest doesn't emulate anything that looks like a bluetooth device or
has bluetooth capabilities.
Thanks,
Sasha
^ permalink raw reply [flat|nested] 2+ messages in thread[parent not found: <50A272E7.9080103-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>]
* Re: net, bluetooth: object debug warning in bt_host_release() [not found] ` <50A272E7.9080103-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org> @ 2012-11-21 17:27 ` Gustavo Padovan 0 siblings, 0 replies; 2+ messages in thread From: Gustavo Padovan @ 2012-11-21 17:27 UTC (permalink / raw) To: Sasha Levin Cc: marcel-kz+m5ild9QBg9hUCZPvPmw, Johan Hedberg, David S. Miller, linux-bluetooth-u79uwXL29TY76Z2rM5mHXA, netdev-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Dave Jones [-- Attachment #1: Type: text/plain, Size: 5691 bytes --] * Sasha Levin <sasha.levin-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org> [2012-11-13 11:18:47 -0500]: > Hi all, > > While fuzzing with trinity on a KVM tools (lkvm) guest running latest -next kernel I've > stumbled on the following: > > [ 1434.201149] ------------[ cut here ]------------ > [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0() > [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci_power_on+0x0/0x90 > [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-next-20121112-sasha-00018-g2f4ce0e #127 > [ 1434.210760] Call Trace: > [ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0 > [ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0 > [ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50 > [ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0 > [ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310 > [ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0 > [ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230 > [ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20 > [ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20 > [ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330 > [ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20 > [ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0 > [ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190 > [ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10 > [ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60 > [ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20 > [ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30 > [ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60 > [ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250 > [ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0 > [ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10 > [ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0 > [ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0 > [ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17 > [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]--- > > Not that the guest doesn't emulate anything that looks like a bluetooth device or > has bluetooth capabilities. You have a virtual bluetooth device (vhci). That is why you get a bluetooth crash. I think the following patch will fix this issue. Gustavo --- Author: Gustavo Padovan <gustavo.padovan-ZGY8ohtN/8pPYcu2f3hruQ@public.gmane.org> Date: Wed Nov 21 00:50:21 2012 -0200 Bluetooth: cancel power_on work when unregistering the device We need to cancel the hci_power_on work in order to avoid it run when we try to free the hdev. [ 1434.201149] ------------[ cut here ]------------ [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0() [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: _power_on+0x0/0x90 [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-n 20121112-sasha-00018-g2f4ce0e #127 [ 1434.210760] Call Trace: [ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0 [ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0 [ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50 [ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0 [ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310 [ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0 [ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230 [ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20 [ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20 [ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330 [ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20 [ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0 [ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190 [ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10 [ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60 [ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20 [ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30 [ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60 [ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250 [ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0 [ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10 [ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0 [ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0 [ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17 [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]--- Reported-by: Sasha Levin <sasha.levin-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org> Signed-off-by: Gustavo Padovan <gustavo.padovan-ZGY8ohtN/8pPYcu2f3hruQ@public.gmane.org> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 81f4bac..69eb644 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1854,6 +1854,8 @@ void hci_unregister_dev(struct hci_dev *hdev) for (i = 0; i < NUM_REASSEMBLY; i++) kfree_skb(hdev->reassembly[i]); + cancel_work_sync(&hdev->power_on); + if (!test_bit(HCI_INIT, &hdev->flags) && !test_bit(HCI_SETUP, &hdev->dev_flags)) { hci_dev_lock(hdev); [-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --] ^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-11-21 17:27 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-11-13 16:18 net, bluetooth: object debug warning in bt_host_release() Sasha Levin
[not found] ` <50A272E7.9080103-QHcLZuEGTsvQT0dZR+AlfA@public.gmane.org>
2012-11-21 17:27 ` Gustavo Padovan
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).