| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <ddde6e32c358c4847c1aa561f4c77a09d34d46bc.camel@mediatek.com>
Date: Fri, 14 Nov 2025 05:08:52 +0000
From: Chris Lu (陸稚泓) <Chris.Lu@...iatek.com>
To: "luiz.dentz@...il.com" <luiz.dentz@...il.com>
CC: Hao Qin (秦浩) <Hao.Qin@...iatek.com>,
Will-CY Lee (李政穎) <Will-CY.Lee@...iatek.com>,
Steve Lee (李視誠) <steve.lee@...iatek.com>,
"marcel@...tmann.org" <marcel@...tmann.org>,
SS Wu (巫憲欣) <ss.wu@...iatek.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"johan.hedberg@...il.com" <johan.hedberg@...il.com>, Sean Wang
<Sean.Wang@...iatek.com>, "linux-bluetooth@...r.kernel.org"
<linux-bluetooth@...r.kernel.org>, "linux-mediatek@...ts.infradead.org"
<linux-mediatek@...ts.infradead.org>
Subject: Re: [PATCH v1] Bluetooth: btusb: mediatek: Fix kernel crash when
releasing mtk iso interface
Hi Luiz,
Thanks for reviewing the patch, I saw my patch was merged yesterday.
However, I noticed that there is a modification to hci_core.h was
merged along with my patch which wasn't my change.
https://web.git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=529ac8e706c3062d3a8af0739f05911aacffa845
Could you help to check if it's expected or not?
n Wed, 2025-11-12 at 15:53 +0800, Chris Lu wrote:
> When performing reset tests and encountering abnormal card drop
> issues
> that lead to a kernel crash, it is necessary to perform a null check
> before releasing resources to avoid attempting to release a null
> pointer.
>
> <4>[ 29.158070] Hardware name: Google Quigon sku196612/196613 board
> (DT)
> <4>[ 29.158076] Workqueue: hci0 hci_cmd_sync_work [bluetooth]
> <4>[ 29.158154] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -
> SSBS BTYPE=--)
> <4>[ 29.158162] pc : klist_remove+0x90/0x158
> <4>[ 29.158174] lr : klist_remove+0x88/0x158
> <4>[ 29.158180] sp : ffffffc0846b3c00
> <4>[ 29.158185] pmr_save: 000000e0
> <4>[ 29.158188] x29: ffffffc0846b3c30 x28: ffffff80cd31f880 x27:
> ffffff80c1bdc058
> <4>[ 29.158199] x26: dead000000000100 x25: ffffffdbdc624ea3 x24:
> ffffff80c1bdc4c0
> <4>[ 29.158209] x23: ffffffdbdc62a3e6 x22: ffffff80c6c07000 x21:
> ffffffdbdc829290
> <4>[ 29.158219] x20: 0000000000000000 x19: ffffff80cd3e0648 x18:
> 000000031ec97781
> <4>[ 29.158229] x17: ffffff80c1bdc4a8 x16: ffffffdc10576548 x15:
> ffffff80c1180428
> <4>[ 29.158238] x14: 0000000000000000 x13: 000000000000e380 x12:
> 0000000000000018
> <4>[ 29.158248] x11: ffffff80c2a7fd10 x10: 0000000000000000 x9 :
> 0000000100000000
> <4>[ 29.158257] x8 : 0000000000000000 x7 : 7f7f7f7f7f7f7f7f x6 :
> 2d7223ff6364626d
> <4>[ 29.158266] x5 : 0000008000000000 x4 : 0000000000000020 x3 :
> 2e7325006465636e
> <4>[ 29.158275] x2 : ffffffdc11afeff8 x1 : 0000000000000000 x0 :
> ffffffdc11be4d0c
> <4>[ 29.158285] Call trace:
> <4>[ 29.158290] klist_remove+0x90/0x158
> <4>[ 29.158298] device_release_driver_internal+0x20c/0x268
> <4>[ 29.158308] device_release_driver+0x1c/0x30
> <4>[ 29.158316] usb_driver_release_interface+0x70/0x88
> <4>[ 29.158325] btusb_mtk_release_iso_intf+0x68/0xd8 [btusb
> (HASH:e8b6 5)]
> <4>[ 29.158347] btusb_mtk_reset+0x5c/0x480 [btusb (HASH:e8b6 5)]
> <4>[ 29.158361] hci_cmd_sync_work+0x10c/0x188 [bluetooth
> (HASH:a4fa 6)]
> <4>[ 29.158430] process_scheduled_works+0x258/0x4e8
> <4>[ 29.158441] worker_thread+0x300/0x428
> <4>[ 29.158448] kthread+0x108/0x1d0
> <4>[ 29.158455] ret_from_fork+0x10/0x20
> <0>[ 29.158467] Code: 91343000 940139d1 f9400268 927ff914
> (f9401297)
> <4>[ 29.158474] ---[ end trace 0000000000000000 ]---
> <0>[ 29.167129] Kernel panic - not syncing: Oops: Fatal exception
> <2>[ 29.167144] SMP: stopping secondary CPUs
> <4>[ 29.167158] ------------[ cut here ]------------
>
> Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data
> transmission functions")
>
> Signed-off-by: Chris Lu <chris.lu@...iatek.com>
> ---
> drivers/bluetooth/btusb.c | 34 +++++++++++++++++++++++++++-------
> 1 file changed, 27 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index e0e30f00a678..fcc62e2fb641 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -2741,9 +2741,16 @@ static int btusb_recv_event_realtek(struct
> hci_dev *hdev, struct sk_buff *skb)
>
> static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
> {
> - struct btmtk_data *btmtk_data = hci_get_priv(data->hdev);
> + struct btmtk_data *btmtk_data;
> int err;
>
> + if (!data->hdev)
> + return;
> +
> + btmtk_data = hci_get_priv(data->hdev);
> + if (!btmtk_data)
> + return;
> +
> /*
> * The function usb_driver_claim_interface() is documented
> to need
> * locks held if it's not called from a probe routine. The
> code here
> @@ -2765,17 +2772,30 @@ static void btusb_mtk_claim_iso_intf(struct
> btusb_data *data)
>
> static void btusb_mtk_release_iso_intf(struct hci_dev *hdev)
> {
> - struct btmtk_data *btmtk_data = hci_get_priv(hdev);
> + struct btmtk_data *btmtk_data;
> +
> + if (!hdev)
> + return;
> +
> + btmtk_data = hci_get_priv(hdev);
> + if (!btmtk_data)
> + return;
>
> if (test_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags)) {
> usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
> clear_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags);
>
> - dev_kfree_skb_irq(btmtk_data->isopkt_skb);
> - btmtk_data->isopkt_skb = NULL;
> - usb_set_intfdata(btmtk_data->isopkt_intf, NULL);
> - usb_driver_release_interface(&btusb_driver,
> - btmtk_data-
> >isopkt_intf);
> + if (btmtk_data->isopkt_skb) {
> + dev_kfree_skb_irq(btmtk_data->isopkt_skb);
> + btmtk_data->isopkt_skb = NULL;
> + }
> +
> + if (btmtk_data->isopkt_intf) {
> + usb_set_intfdata(btmtk_data->isopkt_intf,
> NULL);
> + usb_driver_release_interface(&btusb_driver,
> + btmtk_data-
> >isopkt_intf);
> + btmtk_data->isopkt_intf = NULL;
> + }
> }
>
> clear_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags);
Thanks a lot!,
Chris Lu
Powered by blists - more mailing lists