linux-kernel - [PATCH RESEND 1/5] Bluetooth: btmtksdio: Fix kernel oops in btmtksdio

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7b4627d5017be2c26ded9daf7fd297bed6614852.1647367024.git.objelf@gmail.com>
Date:   Wed, 16 Mar 2022 02:00:00 +0800
From:   <sean.wang@...iatek.com>
To:     <marcel@...tmann.org>, <johan.hedberg@...il.com>
CC:     <sean.wang@...iatek.com>, <Soul.Huang@...iatek.com>,
        <YN.Chen@...iatek.com>, <Leon.Yen@...iatek.com>,
        <Eric-SY.Chang@...iatek.com>, <Deren.Wu@...iatek.com>,
        <km.lin@...iatek.com>, <robin.chiu@...iatek.com>,
        <Eddie.Chen@...iatek.com>, <ch.yeh@...iatek.com>,
        <posh.sun@...iatek.com>, <ted.huang@...iatek.com>,
        <Eric.Liang@...iatek.com>, <Stella.Chang@...iatek.com>,
        <Tom.Chou@...iatek.com>, <steve.lee@...iatek.com>,
        <jsiuda@...gle.com>, <frankgor@...gle.com>,
        <abhishekpandit@...gle.com>, <michaelfsun@...gle.com>,
        <mcchou@...omium.org>, <shawnku@...gle.com>,
        <linux-bluetooth@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        "Yake Yang" <yake.yang@...iatek.com>
Subject: [PATCH RESEND 1/5] Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt

From: Yake Yang <yake.yang@...iatek.com>

Fix the following kernel oops in btmtksdio_interrrupt

[   14.339134]  btmtksdio_interrupt+0x28/0x54
[   14.339139]  process_sdio_pending_irqs+0x68/0x1a0
[   14.339144]  sdio_irq_work+0x40/0x70
[   14.339154]  process_one_work+0x184/0x39c
[   14.339160]  worker_thread+0x228/0x3e8
[   14.339168]  kthread+0x148/0x3ac
[   14.339176]  ret_from_fork+0x10/0x30

That happened because hdev->power_on is already called before
sdio_set_drvdata which btmtksdio_interrupt handler relies on is not
properly set up.

The details are shown as the below: hci_register_dev would run
queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI
workqueue_struct to complete the power-on sequeunce and thus hci_power_on
may run before sdio_set_drvdata is done in btmtksdio_probe.

The hci_dev_do_open in hci_power_on would initialize the device and enable
the interrupt and thus it is possible that btmtksdio_interrupt is being
called right before sdio_set_drvdata is filled out.

When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled
, the kernel oops is going to happen because btmtksdio_interrupt access an
uninitialized pointer.

Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
Reviewed-by: Mark Chen <markyawenchen@...il.com>
Co-developed-by: Sean Wang <sean.wang@...iatek.com>
Signed-off-by: Sean Wang <sean.wang@...iatek.com>
Signed-off-by: Yake Yang <yake.yang@...iatek.com>
---
 drivers/bluetooth/btmtksdio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
index df3f9d090529..9644069cecbb 100644
--- a/drivers/bluetooth/btmtksdio.c
+++ b/drivers/bluetooth/btmtksdio.c
@@ -1281,6 +1281,8 @@ static int btmtksdio_probe(struct sdio_func *func,
 	hdev->manufacturer = 70;
 	set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
 
+	sdio_set_drvdata(func, bdev);
+
 	err = hci_register_dev(hdev);
 	if (err < 0) {
 		dev_err(&func->dev, "Can't register HCI device\n");
@@ -1288,8 +1290,6 @@ static int btmtksdio_probe(struct sdio_func *func,
 		return err;
 	}
 
-	sdio_set_drvdata(func, bdev);
-
 	/* pm_runtime_enable would be done after the firmware is being
 	 * downloaded because the core layer probably already enables
 	 * runtime PM for this func such as the case host->caps &
-- 
2.25.1