LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Ole Bjørn Midtbø" <omidtbo@cisco.com>,
	"Marcel Holtmann" <marcel@holtmann.org>,
	"Sasha Levin" <sashal@kernel.org>
Subject: [PATCH 4.9 30/43] Bluetooth: hidp: use correct wait queue when removing ctrl_wait
Date: Tue, 24 Aug 2021 13:06:01 -0400	[thread overview]
Message-ID: <20210824170614.710813-31-sashal@kernel.org> (raw)
In-Reply-To: <20210824170614.710813-1-sashal@kernel.org>

From: Ole Bjørn Midtbø <omidtbo@cisco.com>

[ Upstream commit cca342d98bef68151a80b024f7bf5f388d1fbdea ]

A different wait queue was used when removing ctrl_wait than when adding
it. This effectively made the remove operation without locking compared
to other operations on the wait queue ctrl_wait was part of. This caused
issues like below where dead000000000100 is LIST_POISON1 and
dead000000000200 is LIST_POISON2.

 list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \
	but was dead000000000200. (next=ffffffc03ac77de0).
 ------------[ cut here ]------------
 CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G           O    4.4.238+ #9
 ...
 ---[ end trace 0adc2158f0646eac ]---
 Call trace:
 [<ffffffc000443f78>] __list_add+0x38/0xb0
 [<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68
 [<ffffffc00020eecc>] __pollwait+0xec/0x100
 [<ffffffc000d1556c>] bt_sock_poll+0x74/0x200
 [<ffffffc000bdb8a8>] sock_poll+0x110/0x128
 [<ffffffc000210378>] do_sys_poll+0x220/0x480
 [<ffffffc0002106f0>] SyS_poll+0x80/0x138
 [<ffffffc00008510c>] __sys_trace_return+0x0/0x4

 Unable to handle kernel paging request at virtual address dead000000000100
 ...
 CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G        W  O    4.4.238+ #9
 ...
 Call trace:
  [<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8
  [<ffffffc0000f0818>] __wake_up+0x50/0x70
  [<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60
  [<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224
  [<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298
  [<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198
  [<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78
  [<ffffffc000d29934>] hci_event_packet+0x564/0x2e30
  [<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360
  [<ffffffc0000c2218>] process_one_work+0x268/0x460
  [<ffffffc0000c2678>] worker_thread+0x268/0x480
  [<ffffffc0000c94e0>] kthread+0x118/0x128
  [<ffffffc000085070>] ret_from_fork+0x10/0x20
  ---[ end trace 0adc2158f0646ead ]---

Signed-off-by: Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hidp/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 552e00b07196..9ec37c6c8c4a 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1282,7 +1282,7 @@ static int hidp_session_thread(void *arg)
 
 	/* cleanup runtime environment */
 	remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
-	remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
+	remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
 	wake_up_interruptible(&session->report_queue);
 	hidp_del_timer(session);
 
-- 
2.30.2


  parent reply	other threads:[~2021-08-24 17:37 UTC|newest]

Thread overview: 47+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-24 17:05 [PATCH 4.9 00/43] 4.9.281-rc1 review Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 01/43] iio: adc: Fix incorrect exit of for-loop Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 02/43] ASoC: intel: atom: Fix reference to PCM buffer address Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 03/43] i2c: dev: zero out array used for i2c reads from userspace Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 04/43] ACPI: NFIT: Fix support for virtual SPA ranges Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 05/43] ppp: Fix generating ifname when empty IFLA_IFNAME is specified Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 06/43] net: Fix memory leak in ieee802154_raw_deliver Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 07/43] net: bridge: fix memleak in br_add_if() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 08/43] tcp_bbr: fix u32 wrap bug in round logic if bbr_init() called after 2B packets Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 09/43] xen/events: Fix race in set_evtchn_to_irq Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 10/43] x86/tools: Fix objdump version check again Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 11/43] PCI/MSI: Enable and mask MSI-X early Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 12/43] PCI/MSI: Do not set invalid bits in MSI mask Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 13/43] PCI/MSI: Correct misleading comments Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 14/43] PCI/MSI: Use msi_mask_irq() in pci_msi_shutdown() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 15/43] PCI/MSI: Protect msi_desc::masked for multi-MSI Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 16/43] PCI/MSI: Mask all unused MSI-X entries Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 17/43] PCI/MSI: Enforce that MSI-X table entry is masked for update Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 18/43] PCI/MSI: Enforce MSI[X] entry updates to be visible Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 19/43] vmlinux.lds.h: Handle clang's module.{c,d}tor sections Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 20/43] mac80211: drop data frames without key on encrypted links Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 21/43] KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 22/43] x86/fpu: Make init_fpstate correct with optimized XSAVE Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 23/43] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 24/43] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 25/43] dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 26/43] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 27/43] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Sasha Levin
2021-08-24 17:05 ` [PATCH 4.9 28/43] scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 29/43] ARM: dts: nomadik: Fix up interrupt controller node names Sasha Levin
2021-08-24 17:06 ` Sasha Levin [this message]
2021-08-24 17:06 ` [PATCH 4.9 31/43] dccp: add do-while-0 stubs for dccp_pr_debug macros Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 32/43] vhost: Fix the calculation in vhost_overflow() Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 33/43] net: 6pack: fix slab-out-of-bounds in decode_data Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 34/43] net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 35/43] mmc: dw_mmc: call the dw_mci_prep_stop_abort() by default Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 36/43] mmc: dw_mmc: Fix hang on data CRC error Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 37/43] ALSA: hda - fix the 'Capture Switch' value change notifications Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 38/43] ipack: tpci200: fix many double free issues in tpci200_pci_probe Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 39/43] btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 40/43] ASoC: intel: atom: Fix breakage for PCM buffer address setup Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 41/43] locks: print a warning when mount fails due to lack of "mand" support Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 42/43] fs: warn about impending deprecation of mandatory locks Sasha Levin
2021-08-24 17:06 ` [PATCH 4.9 43/43] Linux 4.9.281-rc1 Sasha Levin
2021-08-25 20:26 ` [PATCH 4.9 00/43] 4.9.281-rc1 review Guenter Roeck
2021-08-25 21:17 ` Daniel Díaz
2021-08-25 22:37 ` Shuah Khan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210824170614.710813-31-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=omidtbo@cisco.com \
    --cc=stable@vger.kernel.org \
    --subject='Re: [PATCH 4.9 30/43] Bluetooth: hidp: use correct wait queue when removing ctrl_wait' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).