linux-kernel - Re: [patch V3 17/17] Bluetooth: hci_qca: Fix the teardown problem for real

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <21108e77-f67d-528-dd61-249c5ebe217f@linutronix.de>
Date:   Thu, 24 Nov 2022 14:56:35 +0100 (CET)
From:   Anna-Maria Behnsen <anna-maria@...utronix.de>
To:     Thomas Gleixner <tglx@...utronix.de>
cc:     LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Stephen Boyd <sboyd@...nel.org>,
        Guenter Roeck <linux@...ck-us.net>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Julia Lawall <Julia.Lawall@...ia.fr>,
        Arnd Bergmann <arnd@...db.de>,
        Viresh Kumar <viresh.kumar@...aro.org>,
        Marc Zyngier <maz@...nel.org>,
        Marcel Holtmann <marcel@...tmann.org>,
        Johan Hedberg <johan.hedberg@...il.com>,
        Luiz Augusto von Dentz <luiz.dentz@...il.com>,
        linux-bluetooth@...r.kernel.org,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, netdev@...r.kernel.org,
        Jacob Keller <jacob.e.keller@...el.com>
Subject: Re: [patch V3 17/17] Bluetooth: hci_qca: Fix the teardown problem
 for real

On Wed, 23 Nov 2022, Thomas Gleixner wrote:

> While discussing solutions for the teardown problem which results from
> circular dependencies between timers and workqueues, where timers schedule
> work from their timer callback and workqueues arm the timers from work
> items, it was discovered that the recent fix to the QCA code is incorrect.
> 
> That commit fixes the obvious problem of using del_timer() instead of
> del_timer_sync() and reorders the teardown calls to
> 
>    destroy_workqueue(wq);
>    del_timer_sync(t);
> 
> This makes it less likely to explode, but it's still broken:
> 
>    destroy_workqueue(wq);
>    /* After this point @wq cannot be touched anymore */
> 
>    ---> timer expires
>          queue_work(wq) <---- Results in a NULl pointer dereference

The last NIT (for now...): s/NULl/NULL

Thanks,

	Anna-Maria