From patchwork Fri Feb 24 19:53:12 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhengping Jiang X-Patchwork-Id: 5846 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1114795wrd; Fri, 24 Feb 2023 11:58:44 -0800 (PST) X-Google-Smtp-Source: AK7set9aWFTRPc+86lUxWTPXj6R11fZQ4lZsbw8e/ZdK/+nfVPk6+CdSzt3PBa8Bo9v/13EVa9d7 X-Received: by 2002:a05:6a20:a10b:b0:b9:817e:2ff2 with SMTP id q11-20020a056a20a10b00b000b9817e2ff2mr19835289pzk.57.1677268724490; Fri, 24 Feb 2023 11:58:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677268724; cv=none; d=google.com; s=arc-20160816; b=gc0zXnolvNpNAELA9VFahXIt233OeIWRWAmyKkLHv3bYRh1KGTtipdOxioSybE6tFm DRsPr+tRQiNCc0DbuE17/fZf6LiP/RSKDq9Dfd9ogoG1J8vyhidysHDp/QsPjxEoAhnF Bb9K3PKsKlpdS0tNZgxnJHwmE4JTIP6dQEZ7hSSrdC8STLJGVCl2ivQIzfBvNq1O7+RO /LG7ec11p2fFiVwgu/tNDSMg/Cs4Fb+WUdjop+d7jwzD3gCPj4XBfDCJO/HGbCvBStBL q1PvvxxJ4WCeBC3Ns61Qibk4YAYsYm58WoOImgtd7OjNQpQJ3XDg8TWeQZ5O/sD8gOWn g5Fw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:mime-version:date :dkim-signature; bh=8YOzDd/6L/vKBnSebEe4nvaSdZD321OF0FG44WHcog8=; b=zqPK86+6YxkINHQv0RPm8EDLaI7vAmoTgYP3U08x9lpvGOQ1xbgDYQF50RPwMjR/GF cseXczGQqUi78lbfamXXVfkd0WP/FcYyqY2Kf5nC1ylq+aFYf3lG1HRIG0fJH3C9WtGm 412wBOre1wcWKW2DCo09JJu7xuNwXDHLezx8jokuQgnWyAyUgft9kxM4M79WUg9PS6KA XGCuktckLR9KwC/GwZOSgVGjXBAkoWTHrfqgEBkyj4EUNRtXd9KEyG07Dg94IHkDwOn3 T1Tx31LGKG7BjNDqvBetn5p3ArfjQTDVnvcEyuRBi8tI+IVBg+J6iatKVY6UopinAqpk UQDQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b="WT4/T85d"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y187-20020a638ac4000000b004fb887b4733si6890950pgd.874.2023.02.24.11.58.31; Fri, 24 Feb 2023 11:58:44 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b="WT4/T85d"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229507AbjBXTxT (ORCPT + 99 others); Fri, 24 Feb 2023 14:53:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229615AbjBXTxR (ORCPT ); Fri, 24 Feb 2023 14:53:17 -0500 Received: from mail-pl1-x649.google.com (mail-pl1-x649.google.com [IPv6:2607:f8b0:4864:20::649]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E929530B36 for ; Fri, 24 Feb 2023 11:53:16 -0800 (PST) Received: by mail-pl1-x649.google.com with SMTP id p14-20020a170902e74e00b0019ad833d8a4so213393plf.15 for ; Fri, 24 Feb 2023 11:53:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=8YOzDd/6L/vKBnSebEe4nvaSdZD321OF0FG44WHcog8=; b=WT4/T85dVBxjE51E8WWLMhAavndjTBa0+BF4I0xQ0fDPyRnA/YzJQWGmLvkElaKV9m rQ0inlp89lgMu9ePvEB6QEv7X2KTJ4G8sjeEZyJtEvwcKX5TE2HXHesglNzDcXaYi7W6 KJiY2HD9eKG8xBQ/wjBjvncL+2JIJ5wyLsVqIl7a5AWftGl/olQXcrPI0/CAI0FfZPvL yy4T+xereVFACpDEWXIH/gu2WuCAARPJIL072MgQnFEkwtkEtA+Sbcp0OxISt6vcu1S8 VX05yw1pxu40eyDduVaiI3qwuWmbrkRH8Qny8CKmbLo74Rd5g88xKeAzMpOsPK7iROj6 zFgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=8YOzDd/6L/vKBnSebEe4nvaSdZD321OF0FG44WHcog8=; b=JT7RkpjkGWAq/rDcTbH7dzdKfI0aGsLZDtJih2G1I77Cu1NSAoR1sCT1CCgkJviIni MUGl0w4XJng9OQINy5kDoK/qOcy8NGEe3YpeFaHkaXS05gqmppAnKPTXzOiOF0RC7EIC a0uwpcX1e/f4lIikcs7dWy0eoXhvqc3WwxiA2YYzVWH/5wvm9zrLE0CKBdN0BZV7VOZD RVwoUfy2rxstRcDh5wvtU1xmk6BQZuBp6jx0o4hpEELvEYqiCIh3gorTTnwXcQQrvPFn sIhV6Z9Y2oNgHprhGIO3YRfEml1rA9/EatjmpnsGjWr8dIzLBFJPjk0H9isUy3zK3aYQ PW4Q== X-Gm-Message-State: AO0yUKXFuVTPFCPctF7Z/MWh3QD/uslo+T1CLkfwSOkI7olaAyb3m+1t qrSrvdYDSoawNYPe95tzP9P3b3WYM8/X X-Received: from jiangzp-glinux-dev.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:4c52]) (user=jiangzp job=sendgmr) by 2002:a62:82ce:0:b0:5af:db19:b1c with SMTP id w197-20020a6282ce000000b005afdb190b1cmr3505514pfd.2.1677268395963; Fri, 24 Feb 2023 11:53:15 -0800 (PST) Date: Fri, 24 Feb 2023 11:53:12 -0800 Mime-Version: 1.0 X-Mailer: git-send-email 2.39.2.722.g9855ee24e9-goog Message-ID: <20230224195313.1877313-1-jiangzp@google.com> Subject: [kernel PATCH v2 0/1] Clear workqueue to avoid use-after-free From: Zhengping Jiang To: linux-bluetooth@vger.kernel.org, marcel@holtmann.org, luiz.dentz@gmail.com Cc: mmandlik@google.com, chromeos-bluetooth-upstreaming@chromium.org, Zhengping Jiang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Johan Hedberg , Paolo Abeni , linux-kernel@vger.kernel.org, netdev@vger.kernel.org X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758743730015884199?= X-GMAIL-MSGID: =?utf-8?q?1758743730015884199?= After the hci_sync rework, cmd_sync_work was cleared when calling hci_unregister_dev, but not when powering off the adapter. Use-after-free errors happen when a work is still scheduled when cmd is freed by __mgmt_power_off. Changes in v2: - Add function to clear the queue without stop the timer Changes in v1: - Clear cmd_sync_work queue before clearing the mgmt cmd list Zhengping Jiang (1): Bluetooth: hci_sync: clear workqueue before clear mgmt cmd net/bluetooth/hci_sync.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)