linux-kernel - Re: [PATCH v1 1/2] Bluetooth: btnxpuart: Fix btnxpuart

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <872a2317c504c011c5022b21e35d3d490639525b.camel@toradex.com>
Date:   Wed, 18 Oct 2023 16:23:44 +0000
From:   Marcel Ziswiler <marcel.ziswiler@...adex.com>
To:     "neeraj.sanjaykale@....com" <neeraj.sanjaykale@....com>,
        "linux-bluetooth@...r.kernel.org" <linux-bluetooth@...r.kernel.org>
CC:     "luiz.dentz@...il.com" <luiz.dentz@...il.com>,
        "sherry.sun@....com" <sherry.sun@....com>,
        "johan.hedberg@...il.com" <johan.hedberg@...il.com>,
        "amitkumar.karwar@....com" <amitkumar.karwar@....com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "marcel@...tmann.org" <marcel@...tmann.org>,
        "ilpo.jarvinen@...ux.intel.com" <ilpo.jarvinen@...ux.intel.com>
Subject: Re: [PATCH v1 1/2] Bluetooth: btnxpuart: Fix btnxpuart_close

Hi Neeraj

On Wed, 2023-10-18 at 15:36 +0000, Neeraj sanjay kale wrote:
> Hi Marcel,
> 
> Thank you for your patch.
> 
> > From: Marcel Ziswiler <marcel@...wiler.com>
> > Sent: Wednesday, October 18, 2023 8:26 PM
> > To: linux-bluetooth@...r.kernel.org
> > Cc: Sherry Sun <sherry.sun@....com>; Johan Hedberg
> > <johan.hedberg@...il.com>; Luiz Augusto von Dentz
> > <luiz.dentz@...il.com>; Neeraj sanjay kale <neeraj.sanjaykale@....com>;
> > linux-kernel@...r.kernel.org; Marcel Holtmann <marcel@...tmann.org>;
> > Marcel Ziswiler <marcel.ziswiler@...adex.com>; Amitkumar Karwar
> > <amitkumar.karwar@....com>; Ilpo Järvinen <ilpo.jarvinen@...ux.intel.com>
> > Subject: [PATCH v1 1/2] Bluetooth: btnxpuart: Fix btnxpuart_close
> > 
> > From: Marcel Ziswiler <marcel.ziswiler@...adex.com>
> > 
> > Unfortunately, btnxpuart_close() may trigger a BUG: scheduling while atomic.
> > Fix this by properly purging the transmit queue and freeing the receive skb.
> > 
> > Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP
> > Bluetooth chipsets")
> > 
> > Signed-off-by: Marcel Ziswiler <marcel.ziswiler@...adex.com>
> > ---
> > 
> >  drivers/bluetooth/btnxpuart.c | 3 +++
> >  1 file changed, 3 insertions(+)
> > 
> > diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> > index b7e66b7ac570..9cb7529eef09 100644
> > --- a/drivers/bluetooth/btnxpuart.c
> > +++ b/drivers/bluetooth/btnxpuart.c
> > @@ -1234,6 +1234,9 @@ static int btnxpuart_close(struct hci_dev *hdev)
> > 
> >         ps_wakeup(nxpdev);
> >         serdev_device_close(nxpdev->serdev);
> > +       skb_queue_purge(&nxpdev->txq);
> > +       kfree_skb(nxpdev->rx_skb);
> > +       nxpdev->rx_skb = NULL;
> >         clear_bit(BTNXPUART_SERDEV_OPEN, &nxpdev->tx_state);
> >         return 0;
> >  }
> This is already done in btnxpuart_flush(), which is called by hci_dev_close_sync(), before it calls
> btnxpuart_close().

Yes, I was also wondering about that.

> Is btnxpuart_flush() not called during your testing?

Yes, I even added some more tracing to confirm this. However, without my fix (which BTW was inspired by looking
at the former hci_mrvl.c driver) this bug is really occuring. Just keep loading/un-loading the kernel module a
few times any you may hit it.

> Thanks,
> Neeraj

Cheers

Marcel