Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-2219-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <7639639c-7c63-44a9-81bc-f9093b70559f@leemhuis.info>
Date: Fri, 1 Mar 2024 06:53:17 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
Content-Language: en-US, de-DE
To: linux-bluetooth@vger.kernel.org
Cc: stable@vger.kernel.org, regressions@lists.linux.dev
References: <20240226213855.GB3202@hostway.ca>
From: "Linux regression tracking #adding (Thorsten Leemhuis)"
 <regressions@leemhuis.info>
Reply-To: Linux regressions mailing list <regressions@lists.linux.dev>
In-Reply-To: <20240226213855.GB3202@hostway.ca>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

On 26.02.24 22:38, Simon Kirby wrote:
> 
> I bisected a regression where reading from a Bluetooth device gets stuck
> in recvfrom() calls. The device here is a Wii Balance Board, using
> https://github.com/initialstate/beerfridge/blob/master/wiiboard_test.py;
> this worked fine in v6.6.1 and v6.6.8, but when I tried on a v6.6.14
> build, the script no longer outputs any readings.
> 
> 1d576c3a5af850bf11fbd103f9ba11aa6d6061fb is the first bad commit
> 
> which maps to upstream commit 2e07e8348ea454615e268222ae3fc240421be768:
> 
> Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
> 
> With this commit in place, as also in v6.7 and v6.7.6, the script does
> not output anything _unless_ I strace the process, in which case a bunch
> of recvmsg() syscalls are shown, and then it hangs again. If I ^C the
> strace and run it a few times, eventually the script will get enough data
> and output a reading.

Thanks for the report. To be sure the issue doesn't fall through the
cracks unnoticed, I'm adding it to regzbot, the Linux kernel regression
tracking bot:

#regzbot ^introduced 2e07e8348ea454
#regzbot title af_bluetooth: reading from a device gets stuck in
recvfrom() calls
#regzbot ignore-activity

Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
That page also explains what to do if mails like this annoy you.