From patchwork Wed Feb 22 00:09:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhengping Jiang X-Patchwork-Id: 60291 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp295258wrd; Tue, 21 Feb 2023 16:15:24 -0800 (PST) X-Google-Smtp-Source: AK7set+XOjNGMWQIqJ7zPKdW3WVMYsrXa14zLsEgAK20TErT2R3anUomSuX8KSe2++WR9JDkPpIv X-Received: by 2002:a05:6402:783:b0:4ac:bbaa:842f with SMTP id d3-20020a056402078300b004acbbaa842fmr6516111edy.39.1677024924068; Tue, 21 Feb 2023 16:15:24 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677024924; cv=none; d=google.com; s=arc-20160816; b=XHPe/V0C3zaM1gYHQgfLOFyGF9cdvwKMeU0uoeGKPKZFfvMoKFweB2tFkt0vx35XFg fwPeXza6AUiIGMQj5QdCFYR9Hw2kOiuWmc5s8LHB422Bx5S/0fOcH10PbsNvIjMHSoL1 2kTiIvbjIYvGf75BbjqmEmGJis/RPisJ6XO9NsK7C3g4JFmrf4WQxYU9UDIOQqbkC7Y2 k/a7AVlbM/CVWUQSqArKnz5GLaj3uuN+T9kz2gBM6/KmZL/0D8zqmG9lSM4z2Le+2r4Q cpBX9OYHWhOuHceUozipBoJgieAYHz3bQByJ8fXPlxubQbC/o+5A3WVjjfnXlxFbBoIT FvOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:dkim-signature; bh=ZCzl63HJ+kqOaqrd0SKFlWgpIbxPIOYTA/3AaIJbOmU=; b=ez1kSf3C7iUydkGSxJFQDb+ELly8atL7NB7FbMyxm5tdjxtaGtNnJhs3joB+63D5YY FI9LnOEhgH8ChGYtkRMziKiZvimMod4ULZQjVsPDFpQctQJ135QSthHMzwFR3eMvAZ6G 8ZHdvfR3x8slkCk6o8K5I5GBcHbKNjbLuhh82++Mwt8t5iCrpZISvhO6rkLbH3PsjEDe daApYpd7wrL9VMtBiFJOlV+YLp/GBO9y0bAbIBW+Q77UG3J0KLKetNav2XAvCyOUUQKM DiAWBugrI5usYQzzljOQR+GPb3uJH7som6A0at23khR/PZuQXZ6l42jB3j3Pqwx8J0DD y+iQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=DMsAdrwl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s20-20020a056402165400b004acb4614ed5si7642239edx.117.2023.02.21.16.15.00; Tue, 21 Feb 2023 16:15:24 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=DMsAdrwl; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230280AbjBVAJh (ORCPT + 99 others); Tue, 21 Feb 2023 19:09:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50452 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230234AbjBVAJe (ORCPT ); Tue, 21 Feb 2023 19:09:34 -0500 Received: from mail-pf1-x449.google.com (mail-pf1-x449.google.com [IPv6:2607:f8b0:4864:20::449]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3F1130B14 for ; Tue, 21 Feb 2023 16:09:26 -0800 (PST) Received: by mail-pf1-x449.google.com with SMTP id j19-20020aa783d3000000b005b9ac633454so3389265pfn.0 for ; Tue, 21 Feb 2023 16:09:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=ZCzl63HJ+kqOaqrd0SKFlWgpIbxPIOYTA/3AaIJbOmU=; b=DMsAdrwlOWOh+lDWt6KAWAmHY+xU0+Wppx7ZSEqrbMPVOJo75bTAz0oE7rAU5aScHL y3yRUJsXtkYzzZyQCaOYNHrLFlMcOW2iUhOoIwZww8hfseI/xNxZFeAvDBvsoxiVbruD GWVsEGPSv+JOxpaf7yocT6lph9F3h+7uoiaTY1atlpnAtHCmBgyUmPSxSR1yQ8OM9x66 XfSmyIr5ycJiPjHdu+x8jE7aVqmZ/+bxMfq19a0xWq8an8UwG9GpYt6hBi1mNOpe1pFZ jjDSX5Yzmg9fpbpkD/OQDNYSRIc61CHYFDo/RZpLVBh3dl35ntqK1+zX9WQLbdowlf2V zbuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ZCzl63HJ+kqOaqrd0SKFlWgpIbxPIOYTA/3AaIJbOmU=; b=EvIktuotvqfN8Nvs/CV6iTeDCy7QMIHAKuCwGWNBL8JNxUIkDzbVH7Gz7Lv5Nd0D+N diHR4g+jX8EJ9LIoKJylLgiEAEJ1MTR40m/NOs8M8SrGuamh6A9TO+TtVAIfROJ4dvWr Dny87jyxQd2RKFr+IO34v29c/Y8ysxAGkfGInfcRjvZF3OLDigQ9kBNBcHFb+pHqIbNT SlIgEcrixqNeDqxYJ+uoRTNMW47nIkEqk9hiMldDwUMLcFG2x8kXOpOqazR6djW0F6UY WE/uz9QrfXPx0bZkccE9ioh8c20WtH03SVlRT2hu3AsrW2VuBl1QoHq+Eqj6KJJjhc8R qYOQ== X-Gm-Message-State: AO0yUKUXyal1GS8go2hkEZlpNL40UZrDUHJd8VsO6uGnKft/CYOH05Vt nNIlUVcBA50WaIzKSoHoP8C9eTY1PtJZ X-Received: from jiangzp-glinux-dev.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:4c52]) (user=jiangzp job=sendgmr) by 2002:a63:3c58:0:b0:4fb:933a:91d with SMTP id i24-20020a633c58000000b004fb933a091dmr874838pgn.11.1677024566128; Tue, 21 Feb 2023 16:09:26 -0800 (PST) Date: Tue, 21 Feb 2023 16:09:14 -0800 In-Reply-To: <20230222000915.2843208-1-jiangzp@google.com> Mime-Version: 1.0 References: <20230222000915.2843208-1-jiangzp@google.com> X-Mailer: git-send-email 2.39.2.637.g21b0678d19-goog Message-ID: <20230221160910.kernel.v1.1.If0578b001c1f12567f2ebcac5856507f1adee745@changeid> Subject: [kernel PATCH v1 1/1] Bluetooth: hci_sync: clear workqueue before clear mgmt cmd From: Zhengping Jiang To: linux-bluetooth@vger.kernel.org, marcel@holtmann.org, luiz.dentz@gmail.com Cc: chromeos-bluetooth-upstreaming@chromium.org, mmandlik@google.com, Zhengping Jiang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Johan Hedberg , Paolo Abeni , linux-kernel@vger.kernel.org, netdev@vger.kernel.org X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758488086839004665?= X-GMAIL-MSGID: =?utf-8?q?1758488086839004665?= Clear cmd_sync_work queue before clearing the mgmt cmd list to avoid racing conditions which cause use-after-free. When powering off the adapter, the mgmt cmd list will be cleared. If a work is queued in the cmd_sync_work queue at the same time, it will cause the risk of use-after-free, as the cmd pointer is not checked before use. Signed-off-by: Zhengping Jiang --- Changes in v1: - Clear cmd_sync_work queue before clearing the mgmt cmd list net/bluetooth/hci_sync.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 117eedb6f709..6609434e3125 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -4840,6 +4840,8 @@ int hci_dev_close_sync(struct hci_dev *hdev) auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF); + hci_cmd_sync_clear(hdev); + if (!auto_off && hdev->dev_type == HCI_PRIMARY && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && hci_dev_test_flag(hdev, HCI_MGMT))