2023-11-17 19:29:56

by Manish Mandlik

Subject: [PATCH v2 1/2] Bluetooth: btusb: Return when coredump trigger cmd fails

Avoid freeing NULL skb when hci command fails.

Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")

Signed-off-by: Manish Mandlik <[email protected]>
---

Changes in v2:
- Fixed a typo in error log in btusb_coredump_qca()

drivers/bluetooth/btusb.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index b8e9de887b5d..35a26440cabd 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3463,8 +3463,11 @@ static void btusb_coredump_qca(struct hci_dev *hdev)
struct sk_buff *skb;

skb = __hci_cmd_sync(hdev, 0xfc0c, 1, param, HCI_CMD_TIMEOUT);
- if (IS_ERR(skb))
- bt_dev_err(hdev, "%s: triggle crash failed (%ld)", __func__, PTR_ERR(skb));
+ if (IS_ERR(skb)) {
+ bt_dev_err(hdev, "%s: trigger crash failed (%ld)", __func__, PTR_ERR(skb));
+ return;
+ }
+
kfree_skb(skb);
}

--
2.43.0.rc0.421.g78406f8d94-goog

2023-11-17 19:29:58

by Manish Mandlik

Subject: [PATCH v2 2/2] Bluetooth: btusb: Fix double free in handle_dump_pkt_qca()

The hci_devcd_init() returns 0 on success. Do not use this return value
when eturning from handle_dump_pkt_qca() as it incorrectly indicates
that it's not a dump packet.

This causes the first dump skb to be processed by both hci_devcd_rx()
and hci_recv_frame() leading to double free.

Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")

Signed-off-by: Manish Mandlik <[email protected]>
---

(no changes since v1)

drivers/bluetooth/btusb.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 35a26440cabd..d23c992502c5 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3531,10 +3531,11 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
goto out;
}

- ret = hci_devcd_init(hdev, dump_size);
- if (ret < 0) {
- bt_dev_err(hdev, "memdump init error(%d)", ret);
- goto out;
+ if (hci_devcd_init(hdev, dump_size) < 0) {
+ bt_dev_err(hdev, "memdump init error");
+ clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
+ kfree_skb(skb);
+ return ret;
}

btdata->qca_dump.ram_dump_size = dump_size;
--
2.43.0.rc0.421.g78406f8d94-goog

2023-11-17 19:57:05

by bluez.test.bot

Subject: RE: [v2,1/2] Bluetooth: btusb: Return when coredump trigger cmd fails

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=802039

---Test result---

Test Summary:
CheckPatch PASS 1.25 seconds
GitLint PASS 0.63 seconds
SubjectPrefix PASS 0.27 seconds
BuildKernel PASS 27.85 seconds
CheckAllWarning PASS 30.67 seconds
CheckSparse PASS 36.17 seconds
CheckSmatch PASS 99.43 seconds
BuildKernel32 PASS 27.06 seconds
TestRunnerSetup PASS 418.24 seconds
TestRunner_l2cap-tester PASS 22.99 seconds
TestRunner_iso-tester PASS 40.48 seconds
TestRunner_bnep-tester PASS 7.39 seconds
TestRunner_mgmt-tester PASS 166.09 seconds
TestRunner_rfcomm-tester PASS 11.09 seconds
TestRunner_sco-tester PASS 14.54 seconds
TestRunner_ioctl-tester PASS 12.09 seconds
TestRunner_mesh-tester PASS 8.94 seconds
TestRunner_smp-tester PASS 9.73 seconds
TestRunner_userchan-tester PASS 7.33 seconds
IncrementalBuild PASS 31.82 seconds



---
Regards,
Linux Bluetooth