2021-06-14 17:48:50

by Luiz Augusto von Dentz

[permalink] [raw]
Subject: [PATCH v2] Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled

From: Luiz Augusto von Dentz <[email protected]>

When receiving a new connection pchan->conn won't be initialized so the
code cannot use bt_dev_dbg as the pointer to hci_dev won't be
accessible.

Fixes: 2e1614f7d61e4 ("Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg")
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
---
net/bluetooth/smp.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 53f984d11bc1..11f853d0500f 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -3231,7 +3231,7 @@ static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
{
struct l2cap_chan *chan;

- bt_dev_dbg(pchan->conn->hcon->hdev, "pchan %p", pchan);
+ BT_DBG("pchan %p", pchan);

chan = l2cap_chan_create();
if (!chan)
@@ -3252,7 +3252,7 @@ static inline struct l2cap_chan *smp_new_conn_cb(struct l2cap_chan *pchan)
*/
atomic_set(&chan->nesting, L2CAP_NESTING_SMP);

- bt_dev_dbg(pchan->conn->hcon->hdev, "created chan %p", chan);
+ BT_DBG("created chan %p", chan);

return chan;
}
@@ -3356,7 +3356,7 @@ static void smp_del_chan(struct l2cap_chan *chan)
{
struct smp_dev *smp;

- bt_dev_dbg(chan->conn->hcon->hdev, "chan %p", chan);
+ BT_DBG("chan %p", chan);

smp = chan->data;
if (smp) {
--
2.31.1


2021-06-14 18:27:20

by bluez.test.bot

[permalink] [raw]
Subject: RE: [v2] Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=500075

---Test result---

Test Summary:
CheckPatch FAIL 0.88 seconds
GitLint FAIL 0.13 seconds
BuildKernel PASS 633.40 seconds
TestRunner: Setup PASS 405.43 seconds
TestRunner: l2cap-tester PASS 3.14 seconds
TestRunner: bnep-tester PASS 2.13 seconds
TestRunner: mgmt-tester PASS 30.37 seconds
TestRunner: rfcomm-tester PASS 2.40 seconds
TestRunner: sco-tester PASS 2.45 seconds
TestRunner: smp-tester PASS 2.42 seconds
TestRunner: userchan-tester PASS 2.08 seconds

Details
##############################
Test: CheckPatch - FAIL - 0.88 seconds
Run checkpatch.pl script with rule in .checkpatch.conf
Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled
WARNING: Unknown commit id '2e1614f7d61e4', maybe rebased or not pulled?
#11:
Fixes: 2e1614f7d61e4 ("Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg")

total: 0 errors, 1 warnings, 0 checks, 24 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.

"[PATCH] Bluetooth: SMP: Fix crash when receiving new connection when" has style problems, please review.

NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL - 0.13 seconds
Run gitlint with rule in .gitlint
Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled
1: T1 Title exceeds max length (77>72): "Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled"
7: B1 Line exceeds max length (87>80): "Fixes: 2e1614f7d61e4 ("Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg")"


##############################
Test: BuildKernel - PASS - 633.40 seconds
Build Kernel with minimal configuration supports Bluetooth


##############################
Test: TestRunner: Setup - PASS - 405.43 seconds
Setup environment for running Test Runner


##############################
Test: TestRunner: l2cap-tester - PASS - 3.14 seconds
Run test-runner with l2cap-tester
Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: bnep-tester - PASS - 2.13 seconds
Run test-runner with bnep-tester
Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: mgmt-tester - PASS - 30.37 seconds
Run test-runner with mgmt-tester
Total: 446, Passed: 433 (97.1%), Failed: 0, Not Run: 13

##############################
Test: TestRunner: rfcomm-tester - PASS - 2.40 seconds
Run test-runner with rfcomm-tester
Total: 9, Passed: 9 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: sco-tester - PASS - 2.45 seconds
Run test-runner with sco-tester
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: smp-tester - PASS - 2.42 seconds
Run test-runner with smp-tester
Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

##############################
Test: TestRunner: userchan-tester - PASS - 2.08 seconds
Run test-runner with userchan-tester
Total: 3, Passed: 3 (100.0%), Failed: 0, Not Run: 0



---
Regards,
Linux Bluetooth


Attachments:
l2cap-tester.log (43.31 kB)
bnep-tester.log (3.47 kB)
mgmt-tester.log (594.25 kB)
rfcomm-tester.log (11.40 kB)
sco-tester.log (9.68 kB)
smp-tester.log (11.55 kB)
userchan-tester.log (5.33 kB)
Download all attachments

2021-06-14 20:24:52

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [PATCH v2] Bluetooth: SMP: Fix crash when receiving new connection when debug is enabled

Hi Luiz,

> When receiving a new connection pchan->conn won't be initialized so the
> code cannot use bt_dev_dbg as the pointer to hci_dev won't be
> accessible.
>
> Fixes: 2e1614f7d61e4 ("Bluetooth: SMP: Convert BT_ERR/BT_DBG to bt_dev_err/bt_dev_dbg")
> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
> ---
> net/bluetooth/smp.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)

patch has been applied to bluetooth-stable tree.

Regards

Marcel