linux-kernel - Re: [PATCH] Bluetooth: fix power

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 13 May 2016 07:51:17 -0700
From:	Marcel Holtmann <marcel@...tmann.org>
To:	Jiri Slaby <jslaby@...e.cz>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	"Gustavo F. Padovan" <gustavo@...ovan.org>,
	Johan Hedberg <johan.hedberg@...il.com>,
	linux-bluetooth@...r.kernel.org
Subject: Re: [PATCH] Bluetooth: fix power_on vs close race

Hi Jiri,

> With all the latest fixes applied, I am still able to reproduce this
> (and other) warning(s):
> WARNING: CPU: 1 PID: 19684 at ../kernel/workqueue.c:4092 destroy_workqueue+0x70a/0x770()
> ...
> Call Trace:
> [<ffffffff819fee81>] ? dump_stack+0xb3/0x112
> [<ffffffff8117377e>] ? warn_slowpath_common+0xde/0x140
> [<ffffffff811ce68a>] ? destroy_workqueue+0x70a/0x770
> [<ffffffff811739ae>] ? warn_slowpath_null+0x2e/0x40
> [<ffffffff811ce68a>] ? destroy_workqueue+0x70a/0x770
> [<ffffffffa0c944c9>] ? hci_unregister_dev+0x2a9/0x720 [bluetooth]
> [<ffffffffa0b301db>] ? vhci_release+0x7b/0xf0 [hci_vhci]
> [<ffffffffa0b30160>] ? vhci_flush+0x50/0x50 [hci_vhci]
> [<ffffffff8117cd73>] ? do_exit+0x863/0x2b90
> 
> This is due to race present in the hci_unregister_dev path.
> hdev->power_on work races with hci_dev_do_close. One tries to open,
> the other tries to close, leading to warning like the above. (Another
> example is a warning in kobject_get or kobject_put depending on who
> wins the race.)
> 
> Fix this by switching those two racers to ensure hdev->power_on never
> triggers while hci_dev_do_close is in progress.
> 
> Signed-off-by: Jiri Slaby <jslaby@...e.cz>
> Cc: Marcel Holtmann <marcel@...tmann.org>
> Cc: Gustavo Padovan <gustavo@...ovan.org>
> Cc: Johan Hedberg <johan.hedberg@...il.com>
> Cc: linux-bluetooth@...r.kernel.org
> ---
> net/bluetooth/hci_core.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel