If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier
may still be accessing it, it can cause the program to crash.
Here's the call trace:
<4>[102152.653246] Call Trace:
<4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth]
<4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth]
<4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth]
<4>[102152.653268] notifier_call_chain+0x43/0x6b
<4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69
<4>[102152.653273] __pm_notifier_call_chain+0x22/0x39
<4>[102152.653276] pm_suspend+0x287/0x57c
<4>[102152.653278] state_store+0xae/0xe5
<4>[102152.653281] kernfs_fop_write+0x109/0x173
<4>[102152.653284] __vfs_write+0x16f/0x1a2
<4>[102152.653287] ? selinux_file_permission+0xca/0x16f
<4>[102152.653289] ? security_file_permission+0x36/0x109
<4>[102152.653291] vfs_write+0x114/0x21d
<4>[102152.653293] __x64_sys_write+0x7b/0xdb
<4>[102152.653296] do_syscall_64+0x59/0x194
<4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
This patch holds the reference count of the hci_dev object while
processing it in hci_suspend_notifier to avoid potential crash
caused by the race condition.
Signed-off-by: Ying Hsu <[email protected]>
---
Tested with 100 times suspend/resume on a Chromebook device.
net/bluetooth/hci_core.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b421e196f60c..bdbe26ffbd39 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2434,6 +2434,9 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
return NOTIFY_DONE;
+ /* To avoid a potential race with hci_unregister_dev. */
+ hci_dev_hold(hdev);
+
if (action == PM_SUSPEND_PREPARE)
ret = hci_suspend_dev(hdev);
else if (action == PM_POST_SUSPEND)
@@ -2443,6 +2446,7 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
action, ret);
+ hci_dev_put(hdev);
return NOTIFY_DONE;
}
--
2.41.0.255.g8b1d071c50-goog
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=762867
---Test result---
Test Summary:
CheckPatch PASS 0.67 seconds
GitLint PASS 0.31 seconds
SubjectPrefix PASS 0.09 seconds
BuildKernel PASS 40.45 seconds
CheckAllWarning PASS 44.29 seconds
CheckSparse PASS 49.58 seconds
CheckSmatch PASS 134.53 seconds
BuildKernel32 PASS 38.85 seconds
TestRunnerSetup PASS 594.80 seconds
TestRunner_l2cap-tester PASS 28.84 seconds
TestRunner_iso-tester PASS 63.10 seconds
TestRunner_bnep-tester PASS 13.19 seconds
TestRunner_mgmt-tester PASS 256.80 seconds
TestRunner_rfcomm-tester PASS 20.28 seconds
TestRunner_sco-tester PASS 20.72 seconds
TestRunner_ioctl-tester PASS 22.56 seconds
TestRunner_mesh-tester PASS 16.72 seconds
TestRunner_smp-tester PASS 17.53 seconds
TestRunner_userchan-tester PASS 14.28 seconds
IncrementalBuild PASS 37.29 seconds
---
Regards,
Linux Bluetooth
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:
On Wed, 5 Jul 2023 21:06:47 +0000 you wrote:
> If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier
> may still be accessing it, it can cause the program to crash.
> Here's the call trace:
> <4>[102152.653246] Call Trace:
> <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth]
> <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth]
> <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth]
> <4>[102152.653268] notifier_call_chain+0x43/0x6b
> <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69
> <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39
> <4>[102152.653276] pm_suspend+0x287/0x57c
> <4>[102152.653278] state_store+0xae/0xe5
> <4>[102152.653281] kernfs_fop_write+0x109/0x173
> <4>[102152.653284] __vfs_write+0x16f/0x1a2
> <4>[102152.653287] ? selinux_file_permission+0xca/0x16f
> <4>[102152.653289] ? security_file_permission+0x36/0x109
> <4>[102152.653291] vfs_write+0x114/0x21d
> <4>[102152.653293] __x64_sys_write+0x7b/0xdb
> <4>[102152.653296] do_syscall_64+0x59/0x194
> <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
>
> [...]
Here is the summary with links:
- Bluetooth: Fix hci_suspend_sync crash
https://git.kernel.org/bluetooth/bluetooth-next/c/0c9bf63ad8ca
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html