linux-kernel - RE: [PATCH] Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID:
 <DU0PR04MB9496ED073E08FBF57FA2038990F02@DU0PR04MB9496.eurprd04.prod.outlook.com>
Date: Mon, 27 May 2024 07:15:48 +0000
From: Bough Chen <haibo.chen@....com>
To: Luke Wang <ziniu.wang_1@....com>, "marcel@...tmann.org"
	<marcel@...tmann.org>, "luiz.dentz@...il.com" <luiz.dentz@...il.com>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>
CC: "linux-bluetooth@...r.kernel.org" <linux-bluetooth@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, Amitkumar
 Karwar <amitkumar.karwar@....com>, Rohit Fule <rohit.fule@....com>, Neeraj
 Sanjay Kale <neeraj.sanjaykale@....com>, Sherry Sun <sherry.sun@....com>, Jun
 Li <jun.li@....com>, Guillaume Legoupil <guillaume.legoupil@....com>, Salim
 Chebbo <salim.chebbo@....com>, "imx@...ts.linux.dev" <imx@...ts.linux.dev>
Subject: RE: [PATCH] Bluetooth: btnxpuart: Shutdown timer and prevent rearming
 when driver unloading

> -----Original Message-----
> From: Luke Wang <ziniu.wang_1@....com>
> Sent: 2024年5月17日 19:16
> To: marcel@...tmann.org; luiz.dentz@...il.com
> Cc: linux-bluetooth@...r.kernel.org; linux-kernel@...r.kernel.org; Amitkumar
> Karwar <amitkumar.karwar@....com>; Rohit Fule <rohit.fule@....com>;
> Neeraj Sanjay Kale <neeraj.sanjaykale@....com>; Sherry Sun
> <sherry.sun@....com>; Bough Chen <haibo.chen@....com>; Jun Li
> <jun.li@....com>; Guillaume Legoupil <guillaume.legoupil@....com>; Salim
> Chebbo <salim.chebbo@....com>; imx@...ts.linux.dev
> Subject: [PATCH] Bluetooth: btnxpuart: Shutdown timer and prevent rearming
> when driver unloading
> 
> From: Luke Wang <ziniu.wang_1@....com>
> 
> When unload the btnxpuart driver, its associated timer will be deleted.
> If the timer happens to be modified at this moment, it leads to the kernel call
> this timer even after the driver unloaded, resulting in kernel panic.
> Use timer_shutdown_sync() instead of del_timer_sync() to prevent rearming.
> 
> panic log:
>   Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP
>   Modules linked in: algif_hash algif_skcipher af_alg moal(O) mlan(O)
> crct10dif_ce polyval_ce polyval_generic   snd_soc_imx_card
> snd_soc_fsl_asoc_card snd_soc_imx_audmux mxc_jpeg_encdec v4l2_jpeg
> snd_soc_wm8962 snd_soc_fsl_micfil   snd_soc_fsl_sai flexcan snd_soc_fsl_utils
> ap130x rpmsg_ctrl imx_pcm_dma can_dev rpmsg_char pwm_fan fuse [last
> unloaded:   btnxpuart]
>   CPU: 5 PID: 723 Comm: memtester Tainted: G           O
> 6.6.23-lts-next-06207-g4aef2658ac28 #1
>   Hardware name: NXP i.MX95 19X19 board (DT)
>   pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>   pc : 0xffff80007a2cf464
>   lr : call_timer_fn.isra.0+0x24/0x80
> ...
>   Call trace:
>    0xffff80007a2cf464
>    __run_timers+0x234/0x280
>    run_timer_softirq+0x20/0x40
>    __do_softirq+0x100/0x26c
>    ____do_softirq+0x10/0x1c
>    call_on_irq_stack+0x24/0x4c
>    do_softirq_own_stack+0x1c/0x2c
>    irq_exit_rcu+0xc0/0xdc
>    el0_interrupt+0x54/0xd8
>    __el0_irq_handler_common+0x18/0x24
>    el0t_64_irq_handler+0x10/0x1c
>    el0t_64_irq+0x190/0x194
>   Code: ???????? ???????? ???????? ???????? (????????)
>   ---[ end trace 0000000000000000 ]---
>   Kernel panic - not syncing: Oops: Fatal exception in interrupt
>   SMP: stopping secondary CPUs
>   Kernel Offset: disabled
>   CPU features: 0x0,c0000000,40028143,1000721b
>   Memory Limit: none
>   ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---


Hi all,

This patch is already accepted, but I notice it lack fix tag, can anyone help add the following fix tag?
Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets")
Cc: stable@...r.kernel.org

This patch should also put into stable tree. I add the stable tree mail list here. 

Best Regards
Haibo Chen
> 
> Signed-off-by: Luke Wang <ziniu.wang_1@....com>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c index
> 7f88b6f52f26..77f974a5251b 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -328,7 +328,7 @@ static void ps_cancel_timer(struct btnxpuart_dev
> *nxpdev)
>  	struct ps_data *psdata = &nxpdev->psdata;
> 
>  	flush_work(&psdata->work);
> -	del_timer_sync(&psdata->ps_timer);
> +	timer_shutdown_sync(&psdata->ps_timer);
>  }
> 
>  static void ps_control(struct hci_dev *hdev, u8 ps_state)
> --
> 2.34.1