Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Hawkins Jiawei <yin31149@gmail.com>
To:     luiz.dentz@gmail.com
Cc:     linux-bluetooth@vger.kernel.org,
        Hawkins Jiawei <yin31149@gmail.com>
Subject: Re: [PATCH 1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Date:   Wed, 21 Sep 2022 13:50:26 +0800
Message-Id: <20220921055026.380196-1-yin31149@gmail.com>
In-Reply-To: <20220919175700.1649726-1-luiz.dentz@gmail.com>
References: <20220919175700.1649726-1-luiz.dentz@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> device_add shall not be called multiple times as stated in its
> documentation:
> 
>  'Do not call this routine or device_register() more than once for
>  any device structure'
> 
> Syzkaller reports a bug as follows [1]:
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:33!
> invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> [...]
> Call Trace:
>  <TASK>
>  __list_add include/linux/list.h:69 [inline]
>  list_add_tail include/linux/list.h:102 [inline]
>  kobj_kset_join lib/kobject.c:164 [inline]
>  kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
>  kobject_add_varg lib/kobject.c:358 [inline]
>  kobject_add+0x150/0x1c0 lib/kobject.c:410
>  device_add+0x368/0x1e90 drivers/base/core.c:3452
>  hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
>  hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
>  hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
>  hci_event_func net/bluetooth/hci_event.c:7440 [inline]
>  hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
>  hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
>  process_one_work+0x991/0x1610 kernel/workqueue.c:2289
>  worker_thread+0x665/0x1080 kernel/workqueue.c:2436
>  kthread+0x2e4/0x3a0 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
>  </TASK>
> 
> Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
I tried the reproducer from syzkaller, and it didn't trigger any issues.
And I also tryied multiple HCI_LE_CIS_Estabilished events, still normal.

Test-by: Hawkins Jiawei <yin31149@gmail.com>

> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  net/bluetooth/hci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
> index 4e3e0451b08c..08542dfc2dc5 100644
> --- a/net/bluetooth/hci_sysfs.c
> +++ b/net/bluetooth/hci_sysfs.c
> @@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
>  
>  	BT_DBG("conn %p", conn);
>  
> +	if (device_is_registered(&conn->dev))
> +		return;
> +
>  	dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
>  
>  	if (device_add(&conn->dev) < 0) {
> -- 
> 2.37.3