* [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel
@ 2021-11-08 20:01 Jesse Melhuish
2021-11-11 18:23 ` Jesse Melhuish
2021-11-11 18:43 ` Marcel Holtmann
0 siblings, 2 replies; 5+ messages in thread
From: Jesse Melhuish @ 2021-11-08 20:01 UTC (permalink / raw)
To: linux-bluetooth
Cc: Jesse Melhuish, Abhishek Pandit-Subedi, Sonny Sasaka,
David S. Miller, Jakub Kicinski, Johan Hedberg,
Luiz Augusto von Dentz, Marcel Holtmann, linux-kernel, netdev
A race condition is triggered when usermode control is given to
userspace before the kernel's MSFT query responds, resulting in an
unexpected response to userspace's reset command.
Issue can be observed in btmon:
< HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
05 01 ..
@ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
< HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
> HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
Vendor (0x3f|0x001e) ncmd 1
Status: Command Disallowed (0x0c)
05 .
> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
Reset (0x03|0x0003) ncmd 2
Status: Success (0x00)
Signed-off-by: Jesse Melhuish <melhuishj@chromium.org>
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reviewed-by: Sonny Sasaka <sonnysasaka@chromium.org>
---
Changes in v2:
- Moved guard to the new home for this code.
net/bluetooth/hci_sync.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index b794605dc882..5f1f59ac1813 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -3887,8 +3887,10 @@ int hci_dev_open_sync(struct hci_dev *hdev)
hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
ret = hdev->set_diag(hdev, true);
- msft_do_open(hdev);
- aosp_do_open(hdev);
+ if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
+ msft_do_open(hdev);
+ aosp_do_open(hdev);
+ }
clear_bit(HCI_INIT, &hdev->flags);
--
2.31.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel
2021-11-08 20:01 [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel Jesse Melhuish
@ 2021-11-11 18:23 ` Jesse Melhuish
2021-11-11 18:43 ` Marcel Holtmann
1 sibling, 0 replies; 5+ messages in thread
From: Jesse Melhuish @ 2021-11-11 18:23 UTC (permalink / raw)
To: Jesse Melhuish
Cc: linux-bluetooth, Abhishek Pandit-Subedi, Sonny Sasaka,
David S. Miller, Jakub Kicinski, Johan Hedberg,
Luiz Augusto von Dentz, Marcel Holtmann, linux-kernel, netdev
Pinging. LMK if something is wrong or missing here. Thanks!
On Mon, Nov 8, 2021 at 2:01 PM Jesse Melhuish <melhuishj@chromium.org> wrote:
>
> A race condition is triggered when usermode control is given to
> userspace before the kernel's MSFT query responds, resulting in an
> unexpected response to userspace's reset command.
>
> Issue can be observed in btmon:
> < HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
> 05 01 ..
> @ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
> < HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
> > HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
> Vendor (0x3f|0x001e) ncmd 1
> Status: Command Disallowed (0x0c)
> 05 .
> > HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
> Reset (0x03|0x0003) ncmd 2
> Status: Success (0x00)
>
> Signed-off-by: Jesse Melhuish <melhuishj@chromium.org>
> Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
> Reviewed-by: Sonny Sasaka <sonnysasaka@chromium.org>
> ---
>
> Changes in v2:
> - Moved guard to the new home for this code.
>
> net/bluetooth/hci_sync.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> index b794605dc882..5f1f59ac1813 100644
> --- a/net/bluetooth/hci_sync.c
> +++ b/net/bluetooth/hci_sync.c
> @@ -3887,8 +3887,10 @@ int hci_dev_open_sync(struct hci_dev *hdev)
> hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
> ret = hdev->set_diag(hdev, true);
>
> - msft_do_open(hdev);
> - aosp_do_open(hdev);
> + if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
> + msft_do_open(hdev);
> + aosp_do_open(hdev);
> + }
>
> clear_bit(HCI_INIT, &hdev->flags);
>
> --
> 2.31.0
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel
2021-11-08 20:01 [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel Jesse Melhuish
2021-11-11 18:23 ` Jesse Melhuish
@ 2021-11-11 18:43 ` Marcel Holtmann
2021-11-12 22:50 ` Jesse Melhuish
1 sibling, 1 reply; 5+ messages in thread
From: Marcel Holtmann @ 2021-11-11 18:43 UTC (permalink / raw)
To: Jesse Melhuish
Cc: linux-bluetooth, Abhishek Pandit-Subedi, Sonny Sasaka,
David S. Miller, Jakub Kicinski, Johan Hedberg,
Luiz Augusto von Dentz, linux-kernel, netdev
Hi Jesse,
> A race condition is triggered when usermode control is given to
> userspace before the kernel's MSFT query responds, resulting in an
> unexpected response to userspace's reset command.
>
> Issue can be observed in btmon:
> < HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
> 05 01 ..
> @ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
> < HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
>> HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
> Vendor (0x3f|0x001e) ncmd 1
> Status: Command Disallowed (0x0c)
> 05 .
>> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
> Reset (0x03|0x0003) ncmd 2
> Status: Success (0x00)
>
> Signed-off-by: Jesse Melhuish <melhuishj@chromium.org>
> Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
> Reviewed-by: Sonny Sasaka <sonnysasaka@chromium.org>
> ---
>
> Changes in v2:
> - Moved guard to the new home for this code.
>
> net/bluetooth/hci_sync.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> index b794605dc882..5f1f59ac1813 100644
> --- a/net/bluetooth/hci_sync.c
> +++ b/net/bluetooth/hci_sync.c
> @@ -3887,8 +3887,10 @@ int hci_dev_open_sync(struct hci_dev *hdev)
> hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
> ret = hdev->set_diag(hdev, true);
>
> - msft_do_open(hdev);
> - aosp_do_open(hdev);
> + if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
> + msft_do_open(hdev);
> + aosp_do_open(hdev);
> + }
but then you need to do the same on hci_dev_close. Also it would be good to extend userchan-tester with test cases for this.
Regards
Marcel
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel
2021-11-11 18:43 ` Marcel Holtmann
@ 2021-11-12 22:50 ` Jesse Melhuish
2021-11-12 23:03 ` Jesse Melhuish
0 siblings, 1 reply; 5+ messages in thread
From: Jesse Melhuish @ 2021-11-12 22:50 UTC (permalink / raw)
To: Marcel Holtmann
Cc: Jesse Melhuish, linux-bluetooth, Abhishek Pandit-Subedi,
Sonny Sasaka, David S. Miller, Jakub Kicinski, Johan Hedberg,
Luiz Augusto von Dentz, linux-kernel, netdev
Hi Marcel,
No problem, thanks. Happy to extend userchan-tester; do you mind if we
continue reviewing this patch for approval in the meantime so we can
mitigate the issue on our end?
On Thu, Nov 11, 2021 at 12:43 PM Marcel Holtmann <marcel@holtmann.org> wrote:
>
> Hi Jesse,
>
> > A race condition is triggered when usermode control is given to
> > userspace before the kernel's MSFT query responds, resulting in an
> > unexpected response to userspace's reset command.
> >
> > Issue can be observed in btmon:
> > < HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
> > 05 01 ..
> > @ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
> > < HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
> >> HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
> > Vendor (0x3f|0x001e) ncmd 1
> > Status: Command Disallowed (0x0c)
> > 05 .
> >> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
> > Reset (0x03|0x0003) ncmd 2
> > Status: Success (0x00)
> >
> > Signed-off-by: Jesse Melhuish <melhuishj@chromium.org>
> > Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
> > Reviewed-by: Sonny Sasaka <sonnysasaka@chromium.org>
> > ---
> >
> > Changes in v2:
> > - Moved guard to the new home for this code.
> >
> > net/bluetooth/hci_sync.c | 6 ++++--
> > 1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> > index b794605dc882..5f1f59ac1813 100644
> > --- a/net/bluetooth/hci_sync.c
> > +++ b/net/bluetooth/hci_sync.c
> > @@ -3887,8 +3887,10 @@ int hci_dev_open_sync(struct hci_dev *hdev)
> > hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
> > ret = hdev->set_diag(hdev, true);
> >
> > - msft_do_open(hdev);
> > - aosp_do_open(hdev);
> > + if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
> > + msft_do_open(hdev);
> > + aosp_do_open(hdev);
> > + }
>
> but then you need to do the same on hci_dev_close. Also it would be good to extend userchan-tester with test cases for this.
>
> Regards
>
> Marcel
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel
2021-11-12 22:50 ` Jesse Melhuish
@ 2021-11-12 23:03 ` Jesse Melhuish
0 siblings, 0 replies; 5+ messages in thread
From: Jesse Melhuish @ 2021-11-12 23:03 UTC (permalink / raw)
To: Jesse Melhuish
Cc: Marcel Holtmann, linux-bluetooth, Abhishek Pandit-Subedi,
Sonny Sasaka, David S. Miller, Jakub Kicinski, Johan Hedberg,
Luiz Augusto von Dentz, linux-kernel, netdev
Hi Marcel,
Forgot to include: patch v3 incorporating your feedback will follow
very shortly.
On Fri, Nov 12, 2021 at 4:50 PM Jesse Melhuish <melhuishj@chromium.org> wrote:
>
> Hi Marcel,
>
> No problem, thanks. Happy to extend userchan-tester; do you mind if we
> continue reviewing this patch for approval in the meantime so we can
> mitigate the issue on our end?
>
> On Thu, Nov 11, 2021 at 12:43 PM Marcel Holtmann <marcel@holtmann.org> wrote:
> >
> > Hi Jesse,
> >
> > > A race condition is triggered when usermode control is given to
> > > userspace before the kernel's MSFT query responds, resulting in an
> > > unexpected response to userspace's reset command.
> > >
> > > Issue can be observed in btmon:
> > > < HCI Command: Vendor (0x3f|0x001e) plen 2 #3 [hci0]
> > > 05 01 ..
> > > @ USER Open: bt_stack_manage (privileged) version 2.22 {0x0002} [hci0]
> > > < HCI Command: Reset (0x03|0x0003) plen 0 #4 [hci0]
> > >> HCI Event: Command Complete (0x0e) plen 5 #5 [hci0]
> > > Vendor (0x3f|0x001e) ncmd 1
> > > Status: Command Disallowed (0x0c)
> > > 05 .
> > >> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0]
> > > Reset (0x03|0x0003) ncmd 2
> > > Status: Success (0x00)
> > >
> > > Signed-off-by: Jesse Melhuish <melhuishj@chromium.org>
> > > Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
> > > Reviewed-by: Sonny Sasaka <sonnysasaka@chromium.org>
> > > ---
> > >
> > > Changes in v2:
> > > - Moved guard to the new home for this code.
> > >
> > > net/bluetooth/hci_sync.c | 6 ++++--
> > > 1 file changed, 4 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
> > > index b794605dc882..5f1f59ac1813 100644
> > > --- a/net/bluetooth/hci_sync.c
> > > +++ b/net/bluetooth/hci_sync.c
> > > @@ -3887,8 +3887,10 @@ int hci_dev_open_sync(struct hci_dev *hdev)
> > > hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
> > > ret = hdev->set_diag(hdev, true);
> > >
> > > - msft_do_open(hdev);
> > > - aosp_do_open(hdev);
> > > + if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
> > > + msft_do_open(hdev);
> > > + aosp_do_open(hdev);
> > > + }
> >
> > but then you need to do the same on hci_dev_close. Also it would be good to extend userchan-tester with test cases for this.
> >
> > Regards
> >
> > Marcel
> >
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-11-12 23:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-08 20:01 [PATCH v2] Bluetooth: Don't initialize msft/aosp when using user channel Jesse Melhuish
2021-11-11 18:23 ` Jesse Melhuish
2021-11-11 18:43 ` Marcel Holtmann
2021-11-12 22:50 ` Jesse Melhuish
2021-11-12 23:03 ` Jesse Melhuish
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.