iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
40e0b09081
linux/drivers/bluetooth
History
Krzysztof Kozlowski 272970be3d Bluetooth: hci_qca: Fix driver shutdown on closed serdev 
The driver shutdown callback (which sends EDL_SOC_RESET to the device
over serdev) should not be invoked when HCI device is not open (e.g. if
hci_dev_open_sync() failed), because the serdev and its TTY are not open
either.  Also skip this step if device is powered off
(qca_power_shutdown()).

The shutdown callback causes use-after-free during system reboot with
Qualcomm Atheros Bluetooth:

  Unable to handle kernel paging request at virtual address
  0072662f67726fd7
  ...
  CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G        W
  6.1.0-rt5-00325-g8a5f56bcfcca #8
  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
  Call trace:
   tty_driver_flush_buffer+0x4/0x30
   serdev_device_write_flush+0x24/0x34
   qca_serdev_shutdown+0x80/0x130 [hci_uart]
   device_shutdown+0x15c/0x260
   kernel_restart+0x48/0xac

KASAN report:

  BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50
  Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1

  CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted
  6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28
  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
  Call trace:
   dump_backtrace.part.0+0xdc/0xf0
   show_stack+0x18/0x30
   dump_stack_lvl+0x68/0x84
   print_report+0x188/0x488
   kasan_report+0xa4/0xf0
   __asan_load8+0x80/0xac
   tty_driver_flush_buffer+0x1c/0x50
   ttyport_write_flush+0x34/0x44
   serdev_device_write_flush+0x48/0x60
   qca_serdev_shutdown+0x124/0x274
   device_shutdown+0x1e8/0x350
   kernel_restart+0x48/0xb0
   __do_sys_reboot+0x244/0x2d0
   __arm64_sys_reboot+0x54/0x70
   invoke_syscall+0x60/0x190
   el0_svc_common.constprop.0+0x7c/0x160
   do_el0_svc+0x44/0xf0
   el0_svc+0x2c/0x6c
   el0t_64_sync_handler+0xbc/0x140
   el0t_64_sync+0x190/0x194

Fixes: 7e7bbddd02 ("Bluetooth: hci_qca: Fix qca6390 enable failure after warm reboot")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2023-01-17 15:59:02 -08:00
..
ath3k.c Bluetooth: ath3k: remove superfluous header files 2022-03-18 17:12:09 +01:00
bcm203x.c Bluetooth: bcm203x: remove superfluous header files 2022-03-18 17:12:09 +01:00
bfusb.c
bluecard_cs.c
bpa10x.c
bt3c_cs.c
btbcm.c Bluetooth: hci_bcm: Add BCM4349B1 variant 2022-07-21 17:06:36 -07:00
btbcm.h Bluetooth: hci_bcm: Add support for FW loading in autobaud mode 2022-07-21 17:04:38 -07:00
btintel.c Bluetooth: btintel: Fix missing free skb in btintel_setup_combined() 2022-12-12 14:19:25 -08:00
btintel.h
btmrvl_debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_drv.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_main.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_sdio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmrvl_sdio.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE 2022-06-10 14:51:36 +02:00
btmtk.c Bluetooth: btmtkuart: rely on BT_MTK module 2022-03-18 17:12:07 +01:00
btmtk.h Bluetooth: btmtkuart: rely on BT_MTK module 2022-03-18 17:12:07 +01:00
btmtksdio.c Bluetooth: btmtksdio: Add in-band wakeup support 2022-07-21 17:08:03 -07:00
btmtkuart.c Bluetooth: btmtkuart: fix error handling in mtk_hci_wmt_sync() 2022-03-18 17:12:08 +01:00
btqca.c
btqca.h
btqcomsmd.c
btrsi.c
btrtl.c Bluetooth: btusb: Ignore zero length of USB packets on ALT 6 for specific chip 2022-12-12 14:19:23 -08:00
btrtl.h Bluetooth: btrtl: Add btrealtek data struct 2022-12-12 14:19:23 -08:00
btsdio.c
btusb.c Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave() 2022-12-12 14:19:25 -08:00
dtl1_cs.c
h4_recv.h
hci_ag6xx.c
hci_ath.c
hci_bcm4377.c Bluetooth: hci_bcm4377: Fix missing pci_disable_device() on error in bcm4377_probe() 2022-12-12 14:19:25 -08:00
hci_bcm.c Bluetooth: hci_bcm: Add CYW4373A0 support 2022-12-12 14:19:24 -08:00
hci_bcsp.c treewide: Convert del_timer*() to timer_shutdown*() 2022-12-25 13:38:09 -08:00
hci_h4.c
hci_h5.c Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave() 2022-12-12 14:19:25 -08:00
hci_intel.c Bluetooth: hci_intel: Add check for platform_driver_register 2022-07-21 17:05:10 -07:00
hci_ldisc.c Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure 2022-09-19 10:33:39 -07:00
hci_ll.c Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave() 2022-12-12 14:19:25 -08:00
hci_mrvl.c
hci_nokia.c
hci_qca.c Bluetooth: hci_qca: Fix driver shutdown on closed serdev 2023-01-17 15:59:02 -08:00
hci_serdev.c Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure 2022-09-19 10:33:39 -07:00
hci_uart.h
hci_vhci.c
Kconfig Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards 2022-12-12 14:19:24 -08:00
Makefile Bluetooth: hci_bcm4377: Add new driver for BCM4377 PCIe boards 2022-12-12 14:19:24 -08:00
virtio_bt.c virtio_bt: Fix alignment in configuration struct 2022-12-12 14:19:23 -08:00