linux-kernel - Bluetooth broken for some people with 6.8.2 [Was: [PATCH 6.8 308/715] Bluetooth: hci

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bf267566-c18c-4ad9-9263-8642ecfdef1f@leemhuis.info>
Date: Sat, 30 Mar 2024 15:59:22 +0100
From: "Linux regression tracking (Thorsten Leemhuis)"
 <regressions@...mhuis.info>
To: Sasha Levin <sashal@...nel.org>, linux-kernel@...r.kernel.org,
 stable@...r.kernel.org, Greg KH <gregkh@...uxfoundation.org>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@...el.com>,
 Jakub Kicinski <kuba@...nel.org>,
 Linux kernel regressions list <regressions@...ts.linux.dev>
Subject: Bluetooth broken for some people with 6.8.2 [Was: [PATCH 6.8 308/715]
 Bluetooth: hci_core: Cancel request on command timeout]

On 24.03.24 23:28, Sasha Levin wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@...el.com>
> 
> [ Upstream commit 63298d6e752fc0ec7f5093860af8bc9f047b30c8 ]
> 
> If command has timed out call __hci_cmd_sync_cancel to notify the
> hci_req since it will inevitably cause a timeout.
> 
> This also rework the code around __hci_cmd_sync_cancel since it was
> wrongly assuming it needs to cancel timer as well, but sometimes the
> timers have not been started or in fact they already had timed out in
> which case they don't need to be cancel yet again.
> 
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@...el.com>
> Stable-dep-of: 2615fd9a7c25 ("Bluetooth: hci_sync: Fix overwriting request callback")
> Signed-off-by: Sasha Levin <sashal@...nel.org>

Hey stable team, I wonder if it might be wise to pick up 1c3366abdbe884
("Bluetooth: hci_sync: Fix not checking error on
hci_cmd_sync_cancel_sync") from next
(https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=1c3366abdbe884)
for the next releases of all series that a few days ago received
63298d6e752fc0 ("Bluetooth: hci_core: Cancel request on command timeout").

The latter patch sadly on quite a few systems causes a Oops due to a
NULL pointer dereference and breaks Bluetooth. This was reported for
mainline here (yes, coincidentally it was reported by yours truly):
https://lore.kernel.org/all/08275279-7462-4f4a-a0ee-8aa015f829bc@leemhuis.info/

Now that the patch landed in 6.8.2 it seems to happen there as well
(guess in 6.7 and others, too), as can be seen from this bug report
where multiple people already joined:
https://bugzilla.kernel.org/show_bug.cgi?id=218651

The fix mentioned above is on the way to Linus, but due to unlucky
timing missed this weeks network pull, hence will likely only reach
mainline next Thursday. But the fix afaics has a stable commit id, so
might be worth picking up soon for the stable releases to fix the
regression quickly.

Ciao, Thorsten