Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86831C6FA8E for ; Fri, 24 Feb 2023 19:53:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229619AbjBXTxT (ORCPT ); Fri, 24 Feb 2023 14:53:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229615AbjBXTxR (ORCPT ); Fri, 24 Feb 2023 14:53:17 -0500 Received: from mail-pl1-x649.google.com (mail-pl1-x649.google.com [IPv6:2607:f8b0:4864:20::649]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E929530B36 for ; Fri, 24 Feb 2023 11:53:16 -0800 (PST) Received: by mail-pl1-x649.google.com with SMTP id p14-20020a170902e74e00b0019ad833d8a4so213393plf.15 for ; Fri, 24 Feb 2023 11:53:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=8YOzDd/6L/vKBnSebEe4nvaSdZD321OF0FG44WHcog8=; b=WT4/T85dVBxjE51E8WWLMhAavndjTBa0+BF4I0xQ0fDPyRnA/YzJQWGmLvkElaKV9m rQ0inlp89lgMu9ePvEB6QEv7X2KTJ4G8sjeEZyJtEvwcKX5TE2HXHesglNzDcXaYi7W6 KJiY2HD9eKG8xBQ/wjBjvncL+2JIJ5wyLsVqIl7a5AWftGl/olQXcrPI0/CAI0FfZPvL yy4T+xereVFACpDEWXIH/gu2WuCAARPJIL072MgQnFEkwtkEtA+Sbcp0OxISt6vcu1S8 VX05yw1pxu40eyDduVaiI3qwuWmbrkRH8Qny8CKmbLo74Rd5g88xKeAzMpOsPK7iROj6 zFgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=8YOzDd/6L/vKBnSebEe4nvaSdZD321OF0FG44WHcog8=; b=JT7RkpjkGWAq/rDcTbH7dzdKfI0aGsLZDtJih2G1I77Cu1NSAoR1sCT1CCgkJviIni MUGl0w4XJng9OQINy5kDoK/qOcy8NGEe3YpeFaHkaXS05gqmppAnKPTXzOiOF0RC7EIC a0uwpcX1e/f4lIikcs7dWy0eoXhvqc3WwxiA2YYzVWH/5wvm9zrLE0CKBdN0BZV7VOZD RVwoUfy2rxstRcDh5wvtU1xmk6BQZuBp6jx0o4hpEELvEYqiCIh3gorTTnwXcQQrvPFn sIhV6Z9Y2oNgHprhGIO3YRfEml1rA9/EatjmpnsGjWr8dIzLBFJPjk0H9isUy3zK3aYQ PW4Q== X-Gm-Message-State: AO0yUKXFuVTPFCPctF7Z/MWh3QD/uslo+T1CLkfwSOkI7olaAyb3m+1t qrSrvdYDSoawNYPe95tzP9P3b3WYM8/X X-Google-Smtp-Source: AK7set+ODXNARgX9D6pi5xqfai89uMIZfQY62hBezj+LIOPmnNEWOBHm2uXgyNid4m3LOd11OtLnPqn+jS1c X-Received: from jiangzp-glinux-dev.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:4c52]) (user=jiangzp job=sendgmr) by 2002:a62:82ce:0:b0:5af:db19:b1c with SMTP id w197-20020a6282ce000000b005afdb190b1cmr3505514pfd.2.1677268395963; Fri, 24 Feb 2023 11:53:15 -0800 (PST) Date: Fri, 24 Feb 2023 11:53:12 -0800 Mime-Version: 1.0 X-Mailer: git-send-email 2.39.2.722.g9855ee24e9-goog Message-ID: <20230224195313.1877313-1-jiangzp@google.com> Subject: [kernel PATCH v2 0/1] Clear workqueue to avoid use-after-free From: Zhengping Jiang To: linux-bluetooth@vger.kernel.org, marcel@holtmann.org, luiz.dentz@gmail.com Cc: mmandlik@google.com, chromeos-bluetooth-upstreaming@chromium.org, Zhengping Jiang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Johan Hedberg , Paolo Abeni , linux-kernel@vger.kernel.org, netdev@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org After the hci_sync rework, cmd_sync_work was cleared when calling hci_unregister_dev, but not when powering off the adapter. Use-after-free errors happen when a work is still scheduled when cmd is freed by __mgmt_power_off. Changes in v2: - Add function to clear the queue without stop the timer Changes in v1: - Clear cmd_sync_work queue before clearing the mgmt cmd list Zhengping Jiang (1): Bluetooth: hci_sync: clear workqueue before clear mgmt cmd net/bluetooth/hci_sync.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) -- 2.39.2.722.g9855ee24e9-goog