Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 27 Jul 2022 14:58:42 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     luiz.von.dentz@intel.com
Cc:     linux-bluetooth@vger.kernel.org
Subject: [bug report] Bluetooth: hci_sync: Rework hci_suspend_notifier
Message-ID: <YuEocqGzotojM7vg@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?NFqb8E0QfRkrxGviNI2rMGDGxlqcSMfw26i6h1eAt1qZ3B9vsZLiPb0CY3+V?=
 =?us-ascii?Q?sKXM4E5nLQXT6HQhH5d/SphklJxqOLtgJI8SWk1FO71px0cxMG346ZRcQ1Wf?=
 =?us-ascii?Q?Hv18b0+vB1POSb3IGvYj0JTCnSDVkFN0/t4C1YsQF0GXNq6XA65SN6nG5+EL?=
 =?us-ascii?Q?oZDmWO92yFCbg/+OjjXpQNC89Rl6YjKOlJGNXSNNVPwK+Pd2OUDuvx1UMJ4u?=
 =?us-ascii?Q?AeQzlr24JZodKKOnlNlCQ+6jKKHqT+SS47VhCbm3PFYI6MDTBBEhQFS4Yllv?=
 =?us-ascii?Q?hSub3BJSocFj1VkqihdG6RNuuNIFut0H40JuQ19Iyr33I5fn4cusFr7vdQTZ?=
 =?us-ascii?Q?jVGerzGlBysmPBxeJHdHz/bCmIJKNkLBspOS/1APShaspACF8641/TjPUdLa?=
 =?us-ascii?Q?cY6XNr5QmDkAVpx06atEClkT+/Wrd6yImBEoJFgrzCkdQyvEerM2eWuD16PO?=
 =?us-ascii?Q?1p8u4RKWPQl3BvQWbF5CrmhZX3jB4qLQ1X8YW+Gi/js8c9qo5HlGy42lKXIU?=
 =?us-ascii?Q?EAjJeyTj57+FfAEjMo9IhPCL9DODYtN0cy4N8RpXJHsOfxBHXQqOZWGl3mBz?=
 =?us-ascii?Q?1aZrf6kgMmWBs/zJ2KbvCskxqWubryy7EXzBdCqO4UZAZdnMT+1x/sJGznE+?=
 =?us-ascii?Q?xb3ZD6XnUYrT5kEC4v61dQI0+9Z/C+wt1G5UWwSpwqJr8GhfZjZ5oHp7H13g?=
 =?us-ascii?Q?2n2dLDaJgqu7jQxdVsh9gh08S/lYbVQhzxuJGWMYmV0Vuh7P57kcve2aC8yv?=
 =?us-ascii?Q?5zvEHeGqKEtClltAxD4Z7374NqpS0L40cNVcT/qZ5bszDBFh/EHJePzUufBQ?=
 =?us-ascii?Q?V4r7zCoD/LCGKtnkhSA2e+mGV1KYNenyyzX/1jN6S75X7XuyWQ51wk5YwB8Q?=
 =?us-ascii?Q?YWxa2VoK1kdW6VXGd8gP4cbwNjEsQkUa/1oquTuuyidEGZwoYTgfjuV4FHix?=
 =?us-ascii?Q?KUYMqEElyE3s2WgXcGuKxcwq3d/mXQEXUsdtoPBGMNIRSEcf4IH7q2JN+AmE?=
 =?us-ascii?Q?nkE5BSWh00QTqxWGJTbkaU8W7aw5qs5jtzlqL6hpJ7lXWFNBsjLYqbLD7MwX?=
 =?us-ascii?Q?WDmF5Ywo2IG9BTwvieb8GTtZTf+6ROMJIOm2mMWYwwPnQI5DExjun4e+orc9?=
 =?us-ascii?Q?umiDhzJPzW+a4FvC4Ug+Zw+FspJAVOEZSi51zPo/Bxc1qMMNg19v0gZCBk3K?=
 =?us-ascii?Q?h30iC8hA5G1VkduzuwRHSlUijiYSAvjQvTMuJBZ1ZcBqnRhAVuSR2Hf9ASEW?=
 =?us-ascii?Q?C6hnYamw2677VwahQkKqbskPrQuBQDosH9XcOcBot1szx2so+FjwPZA1Ld1X?=
 =?us-ascii?Q?k0m2JU2vzoobn1oXGjtv0a7O2G1IWgxXTf+U96pxR8BVhTGIOVlj4EvFz+Xv?=
 =?us-ascii?Q?yVW6lFRUbJZs+YQFY7GlfOTFd4ibgFKK1jUzOFebLuQjma1OduB1i49nk8PY?=
 =?us-ascii?Q?nQHS8FyCsAzp7AKzdSIq7orTqXCKuZ37T0vsGcfxkfRE9TWbsLFPXdVm8Gzj?=
 =?us-ascii?Q?rDaP6ESs0EznaVHAdU99qmioBL1HorNu6TW21W+pHGwa7ai4/v0bB7s/HwyF?=
 =?us-ascii?Q?ic703E1+H9bVtKO1Ul+ACn0TBi3OzZENksPo/tyUJ9oVIVHBdZsRtmyOIyps?=
 =?us-ascii?Q?9A=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f1966aad-a1fd-464f-d240-08da6fc75e97
X-MS-Exchange-CrossTenant-AuthSource: CY4PR1001MB2358.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jul 2022 11:58:50.6591
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: ipia+Rbf2z4kvdx78Ugn9Vm+de69dUE/Vwa3dpKU3BnZS6FaO/7N5b/flaJ+CWvRJsBybF3n5EFHhC9R1WGcSkEoWDWWkyI5YS7KpI61dtA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR10MB5163
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-07-27_02,2022-07-27_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 malwarescore=0 phishscore=0
 spamscore=0 mlxlogscore=735 suspectscore=0 bulkscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2207270050
X-Proofpoint-ORIG-GUID: IiBG8UNx1q4iRK3PfHfYx0Yfll7e02Pi
X-Proofpoint-GUID: IiBG8UNx1q4iRK3PfHfYx0Yfll7e02Pi
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Hello Luiz Augusto von Dentz,

The patch 182ee45da083: "Bluetooth: hci_sync: Rework
hci_suspend_notifier" from Oct 27, 2021, leads to the following
Smatch static checker warning:

	net/bluetooth/hci_core.c:1944 hci_add_adv_monitor()
	error: dereferencing freed memory 'monitor'

net/bluetooth/hci_core.c
    1942         case HCI_ADV_MONITOR_EXT_MSFT:
    1943                 status = msft_add_monitor_pattern(hdev, monitor);
--> 1944                 bt_dev_dbg(hdev, "%s add monitor %d msft status %d", hdev->name,
    1945                            monitor->handle, status);
    1946                 break;
    1947         }

The problem is that msft_le_monitor_advertisement_cb() will free
monitor on error.

net/bluetooth/msft.c
   243          monitor->state = ADV_MONITOR_STATE_OFFLOADED;
   244  
   245  unlock:
   246          if (status)
   247                  hci_free_adv_monitor(hdev, monitor);
                            ^^^^                   ^^^^^^^

   248  
   249          hci_dev_unlock(hdev);
   250  
   251          return status;
   252  }

I really think freeing monitor is the wrong thing.  It's a layering
violation.  Other error paths in the callers do not free monitor.  It
leads to other use after frees besides this one that that static checker
found.  For example, it leads to a double free in
__add_adv_patterns_monitor().

regards,
dan carpenter