Received: by 2002:ac0:a582:0:0:0:0:0 with SMTP id m2-v6csp5468573imm; Tue, 16 Oct 2018 10:41:21 -0700 (PDT) X-Google-Smtp-Source: ACcGV62Zz4pbCmoJcNlds5opsrMkQtl3QayNeVWRP1OouHt8RZRMxVD48Frvfli1vqN7rH6WBDpK X-Received: by 2002:a63:480e:: with SMTP id v14-v6mr20926253pga.308.1539711681594; Tue, 16 Oct 2018 10:41:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1539711681; cv=none; d=google.com; s=arc-20160816; b=Ee45s/2+uFQDzWlHBrj+PwAmBc8Mx+MByh/fTnA54l4d+oAKBZCsMx399xAjnQiyD6 d2qXkUPwcd0dthzopBaAAQmSpDNfNR2cN1lCArl5uFn6QXhkiDEFH7agF8EfdHy9HhBi Emp0qSfTjVQarOMfpTOp9MDL4CMSBeoYmQ0lg6MWpyhq0GRCO3ufjdGANrFayi6nGvFQ PcO7/UBHOYZbfU9lQgehScu1QgNy3axl72tMchfMDzX9LkMV24aRb6oSr+JUyVFpFiXW eagY3fmti3kH9yu4qXBLaoNgDBxjcwtv6nn7OtD9YThJVxpXjR62nKH1BLVh5QoDhdjW pk4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ROD/4zvw+i0s/NnDbzT+7AOl8jGRU8QTmu60LnGSsKA=; b=H0O9pd/eTuc7R8K9ujR1LsDD7NLtD2wSbFrkwXRd/bwIkw0jpXIIrrFR6BPKf7LPBF xzCRbPcPn46M1w/z/q9S8G52iTtdqpveOykrupWZAEYzKqVCFKUhZXQggQ/5KR0RHG83 +jUX/D6mGPiO9x7qc5I8ueMCKwKNW6AKerX1BXVhlFihmPSk96JbCav3f2TD00bXe3Rl pEqcXNz6/2tVW/CXvIZK8VRY9/+nktzu3Y53zOjyBULwo3EPZAidiB0goxsEBlZMe9fj 8yroH7a5dCEC3iF61+ZG7NVRH2LfQOoSdGQTX8YyB/NzJbs1zJTgAm3Cu3ILMjRqagBT nxTQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=LfG3GPd7; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id g15-v6si15802115pli.239.2018.10.16.10.41.06; Tue, 16 Oct 2018 10:41:21 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=LfG3GPd7; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729528AbeJQBHU (ORCPT + 99 others); Tue, 16 Oct 2018 21:07:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:51614 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728422AbeJQBHT (ORCPT ); Tue, 16 Oct 2018 21:07:19 -0400 Received: from localhost (ip-213-127-77-176.ip.prioritytelecom.net [213.127.77.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 70F0420866; Tue, 16 Oct 2018 17:15:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1539710156; bh=jE+8Lti9r0Z1XX+kJ4opEb9sh0S0pbRDrTytzRHdGCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LfG3GPd77Wx2rZwUBnhiFsg5oh2CuyBoSH36wUOvduaoLiroU4UXXGUMDeQCGkrhd Ao+Q3YXIcbvUOTFczm1vXAoX8PmvvoI+qjssJ/Ut8cjtlk1QsN1yPsejEvABBGRrx9 NtgZyR2T9KO5w7Gkc67YQtfg69EoI8NKJ5sYt0TY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hermes Zhang , Marcel Holtmann , Sasha Levin Subject: [PATCH 4.18 084/135] Bluetooth: hci_ldisc: Free rw_semaphore on close Date: Tue, 16 Oct 2018 19:05:14 +0200 Message-Id: <20181016170521.052539741@linuxfoundation.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20181016170515.447235311@linuxfoundation.org> References: <20181016170515.447235311@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hermes Zhang [ Upstream commit e6a57d22f787e73635ce0d29eef0abb77928b3e9 ] The percpu_rw_semaphore is not currently freed, and this leads to a crash when the stale rcu callback is invoked. DEBUG_OBJECTS detects this. ODEBUG: free active (active state 1) object type: rcu_head hint: (null) ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2024 at debug_print_object+0xac/0xc8 PC is at debug_print_object+0xac/0xc8 LR is at debug_print_object+0xac/0xc8 Call trace: [] debug_print_object+0xac/0xc8 [] debug_check_no_obj_freed+0x1e8/0x228 [] kfree+0x1cc/0x250 [] hci_uart_tty_close+0x54/0x108 [] tty_ldisc_close.isra.1+0x40/0x58 [] tty_ldisc_kill+0x1c/0x40 [] tty_ldisc_release+0x94/0x170 [] tty_release_struct+0x1c/0x58 [] tty_release+0x3b0/0x490 [] __fput+0x88/0x1d0 [] ____fput+0xc/0x18 [] task_work_run+0x9c/0xc0 [] do_exit+0x24c/0x8a0 [] do_group_exit+0x38/0xa0 [] __wake_up_parent+0x0/0x28 [] el0_svc_naked+0x34/0x38 ---[ end trace bfe08cbd89098cdf ]--- Signed-off-by: Hermes Zhang Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/bluetooth/hci_ldisc.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -543,6 +543,8 @@ static void hci_uart_tty_close(struct tt } clear_bit(HCI_UART_PROTO_SET, &hu->flags); + percpu_free_rwsem(&hu->proto_lock); + kfree(hu); }