From patchwork Fri Feb 24 19:53:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhengping Jiang X-Patchwork-Id: 61427 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp1114858wrd; Fri, 24 Feb 2023 11:58:54 -0800 (PST) X-Google-Smtp-Source: AK7set/ScW44kslWquHUenc2VuIx8oK0gmuWDyxpiwQvLY878tjB8RdWSgcZzvBD5ztGxvfAWZXP X-Received: by 2002:a62:1ccb:0:b0:5a9:d5c7:199a with SMTP id c194-20020a621ccb000000b005a9d5c7199amr14596562pfc.8.1677268733972; Fri, 24 Feb 2023 11:58:53 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1677268733; cv=none; d=google.com; s=arc-20160816; b=scVy/RfQt6oXl7oUl9aJv+a5hp8uvj7tAfTPqIa4Sq6NeJXkeDl/0kh+2rL4MHS1th lPhVAczDTbUmtVRC97VJWAUO2kPe/o2HKS1dEUT4386isA2vI1MH/7/7lLBi+gtUlXLi qUG5kd15nxrItFJV/p1qJqdjQKvaEVKnTFuvjz8pB59BC/mPDBlGxnZKFJkCEBowZXri UwOKtLyx6bXotnbyrnC1k0ysDWmCfB3mVcYx5ghlk151pcMeWobcjsD65c9smNJ/FevK 3bUFq/NS6/owEui5yrVqaH21TYV8NFeYLIcnzcE05BxAfYHk+RAUILirNg1e9+KcXMzq bPQA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:dkim-signature; bh=lkRn+6AoxobFYVvnDPTVGQq+gGNHibmmav9mWkGQcVk=; b=Rmk/r+ER4PXdiIcZR8C1nkqQWYOFvcZqIqm0t6+Jexjqa2mROpb3PGB27tGLEVCyoz HEFU+dZfd/JxgsVtMIvblRcGqqeownf5KOO7dHQJ/GrUdvdUssoDQ1xmeokW5iaAr9R0 QU5yv1ABOTz/8yPoY0eZKOolt1WPlTbqBatpCUBQTUYLo+GX4RNLgdIMz3HqpJ9yxqD8 Snfh8MPz/RMcMUaCiID3jT6CxBKGGxVFtICD7F1r/qNKdPCKZbySAFX4qizkIC0dKn9l nWGERIalPtqcVxS45WFUszvgSuxF8vxxy51drse7bpp37g/xZoTSTosCC6UdXBB0XRBa 8ddQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=ILZLCrgZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id f18-20020a056a0022d200b0056cb8f6f027si17509294pfj.357.2023.02.24.11.58.41; Fri, 24 Feb 2023 11:58:53 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=ILZLCrgZ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229661AbjBXTxV (ORCPT + 99 others); Fri, 24 Feb 2023 14:53:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44142 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229659AbjBXTxS (ORCPT ); Fri, 24 Feb 2023 14:53:18 -0500 Received: from mail-pf1-x449.google.com (mail-pf1-x449.google.com [IPv6:2607:f8b0:4864:20::449]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE84B31E02 for ; Fri, 24 Feb 2023 11:53:17 -0800 (PST) Received: by mail-pf1-x449.google.com with SMTP id 202-20020a6218d3000000b005a89856900eso59186pfy.14 for ; Fri, 24 Feb 2023 11:53:17 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=lkRn+6AoxobFYVvnDPTVGQq+gGNHibmmav9mWkGQcVk=; b=ILZLCrgZS1VLizZWWAK+C1MzdNr6RID8mWa3hzE+XcEW2p6iM/BvO/yRxHWiOSEEgy gYSwauIfvjWlABo2DKzMfpSLuGdnPjEuKIUgTlKzhKRh+odB1SLOlZV+yDufYDWEhxUy WsDH90DLicnkiGnUWJwiT9OWnpMSKDl7RfsPud9BUtPeR+Ks+VTMRRYFBdUOI8SB5jhY NBaABFh0QiuVy14AjA9bAdJQRChJ7oHSMOTA4UYQCdBLtb4FybP1jZsLwElPtf9IXhLF w3I2g4LJ5yfkWDEc5tNZPkNydfd6+LFhQ/rnKnA/m9qv5RR6lMdOwz5AZm9QDj0iv95E BdGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=lkRn+6AoxobFYVvnDPTVGQq+gGNHibmmav9mWkGQcVk=; b=VolZcSHY2OWK+5BoTWX1wmkNMed0u3jP65Q+b/0Hri/0lbqGJdAYTHgK3YJd1/SsBZ IHJQPIBXA0bcXg4M6KiXp7iTWXeZooAU4nOVlczW2k8ll0gEq4QVmlFG0tKhhMy5lFp3 BI4mT3hNvPuMkAzyzC2SU9/rdCMknzWRCCfdLLtE5bf+3+/rEJfaogcNRZEysJAEJ9Xl 8QeDRaBZA06aSAQL9xPAmJilMN9qHqGMnuylsu032GnlWqGGsGKDnGxfxyvv+SaGN445 mLx3hCaPP8axsRFXRCLJd5YzUKMzLoTZNgsDROYRk+aNYcl5A6Mr80fiipXvIsp8ZAgw kWeg== X-Gm-Message-State: AO0yUKVm9wSgMOLCK4v3PANzJo95NJwaTj+p/B6n89YOQRWHCYIjdwPs wOwmFp0vd7IBtJ1yL8Ts14htWhgMgpkA X-Received: from jiangzp-glinux-dev.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:4c52]) (user=jiangzp job=sendgmr) by 2002:a17:903:2348:b0:199:6e3:187a with SMTP id c8-20020a170903234800b0019906e3187amr443395plh.6.1677268397322; Fri, 24 Feb 2023 11:53:17 -0800 (PST) Date: Fri, 24 Feb 2023 11:53:13 -0800 In-Reply-To: <20230224195313.1877313-1-jiangzp@google.com> Mime-Version: 1.0 References: <20230224195313.1877313-1-jiangzp@google.com> X-Mailer: git-send-email 2.39.2.722.g9855ee24e9-goog Message-ID: <20230224115310.kernel.v2.1.If0578b001c1f12567f2ebcac5856507f1adee745@changeid> Subject: [kernel PATCH v2 1/1] Bluetooth: hci_sync: clear workqueue before clear mgmt cmd From: Zhengping Jiang To: linux-bluetooth@vger.kernel.org, marcel@holtmann.org, luiz.dentz@gmail.com Cc: mmandlik@google.com, chromeos-bluetooth-upstreaming@chromium.org, Zhengping Jiang , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Johan Hedberg , Paolo Abeni , linux-kernel@vger.kernel.org, netdev@vger.kernel.org X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1758743740438790070?= X-GMAIL-MSGID: =?utf-8?q?1758743740438790070?= Clear cmd_sync_work queue before clearing the mgmt cmd list to avoid racing conditions which cause use-after-free. When powering off the adapter, the mgmt cmd list will be cleared. If a work is queued in the cmd_sync_work queue at the same time, it will cause the risk of use-after-free, as the cmd pointer is not checked before use. Signed-off-by: Zhengping Jiang --- Changes in v2: - Add function to clear the queue without stop the timer Changes in v1: - Clear cmd_sync_work queue before clearing the mgmt cmd list net/bluetooth/hci_sync.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 117eedb6f709..b70365dfff0c 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -636,6 +636,23 @@ void hci_cmd_sync_init(struct hci_dev *hdev) INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire); } +static void hci_pend_cmd_sync_clear(struct hci_dev *hdev) +{ + struct hci_cmd_sync_work_entry *entry, *tmp; + + mutex_lock(&hdev->cmd_sync_work_lock); + list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) { + if (entry->destroy) { + hci_req_sync_lock(hdev); + entry->destroy(hdev, entry->data, -ECANCELED); + hci_req_sync_unlock(hdev); + } + list_del(&entry->list); + kfree(entry); + } + mutex_unlock(&hdev->cmd_sync_work_lock); +} + void hci_cmd_sync_clear(struct hci_dev *hdev) { struct hci_cmd_sync_work_entry *entry, *tmp; @@ -4842,8 +4859,10 @@ int hci_dev_close_sync(struct hci_dev *hdev) if (!auto_off && hdev->dev_type == HCI_PRIMARY && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && - hci_dev_test_flag(hdev, HCI_MGMT)) + hci_dev_test_flag(hdev, HCI_MGMT)) { + hci_pend_cmd_sync_clear(hdev); __mgmt_power_off(hdev); + } hci_inquiry_cache_flush(hdev); hci_pend_le_actions_clear(hdev);