All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: Hermes Zhang <chenhuiz@axis.com>,
	Marcel Holtmann <marcel@holtmann.org>,
	Sasha Levin <alexander.levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.14 08/23] Bluetooth: hci_ldisc: Free rw_semaphore on close
Date: Fri,  5 Oct 2018 12:16:19 -0400	[thread overview]
Message-ID: <20181005161634.20631-8-sashal@kernel.org> (raw)
In-Reply-To: <20181005161634.20631-1-sashal@kernel.org>

From: Hermes Zhang <chenhuiz@axis.com>

[ Upstream commit e6a57d22f787e73635ce0d29eef0abb77928b3e9 ]

The percpu_rw_semaphore is not currently freed, and this leads to
a crash when the stale rcu callback is invoked.  DEBUG_OBJECTS
detects this.

 ODEBUG: free active (active state 1) object type: rcu_head hint: (null)
 ------------[ cut here ]------------
 WARNING: CPU: 1 PID: 2024 at debug_print_object+0xac/0xc8
 PC is at debug_print_object+0xac/0xc8
 LR is at debug_print_object+0xac/0xc8
 Call trace:
 [<ffffff80082e2c2c>] debug_print_object+0xac/0xc8
 [<ffffff80082e40b0>] debug_check_no_obj_freed+0x1e8/0x228
 [<ffffff8008191254>] kfree+0x1cc/0x250
 [<ffffff80083cc03c>] hci_uart_tty_close+0x54/0x108
 [<ffffff800832e118>] tty_ldisc_close.isra.1+0x40/0x58
 [<ffffff800832e14c>] tty_ldisc_kill+0x1c/0x40
 [<ffffff800832e3dc>] tty_ldisc_release+0x94/0x170
 [<ffffff8008325554>] tty_release_struct+0x1c/0x58
 [<ffffff8008326400>] tty_release+0x3b0/0x490
 [<ffffff80081a3fe8>] __fput+0x88/0x1d0
 [<ffffff80081a418c>] ____fput+0xc/0x18
 [<ffffff80080c0624>] task_work_run+0x9c/0xc0
 [<ffffff80080a9e24>] do_exit+0x24c/0x8a0
 [<ffffff80080aa4e0>] do_group_exit+0x38/0xa0
 [<ffffff80080aa558>] __wake_up_parent+0x0/0x28
 [<ffffff8008082c00>] el0_svc_naked+0x34/0x38
 ---[ end trace bfe08cbd89098cdf ]---

Signed-off-by: Hermes Zhang <chenhuiz@axis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 drivers/bluetooth/hci_ldisc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index c823914b3a80..30bbe19b4b85 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -539,6 +539,8 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 	}
 	clear_bit(HCI_UART_PROTO_SET, &hu->flags);
 
+	percpu_free_rwsem(&hu->proto_lock);
+
 	kfree(hu);
 }
 
-- 
2.17.1


  parent reply	other threads:[~2018-10-05 16:23 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-05 16:16 [PATCH AUTOSEL 4.14 01/23] ASoC: rt5514: Fix the issue of the delay volume applied again Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 02/23] ASoC: wm8804: Add ACPI support Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 03/23] ASoC: sigmadsp: safeload should not have lower byte limit Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 04/23] selftests/efivarfs: add required kernel configs Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 05/23] selftests: memory-hotplug: add required configs Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 06/23] ASoC: rsnd: adg: care clock-frequency size Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 07/23] ASoC: rsnd: don't fallback to PIO mode when -EPROBE_DEFER Sasha Levin
2018-10-05 16:16 ` Sasha Levin [this message]
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 09/23] mfd: omap-usb-host: Fix dts probe of children Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 10/23] scsi: iscsi: target: Don't use stack buffer for scatterlist Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 11/23] scsi: qla2xxx: Fix an endian bug in fcpcmd_is_corrupted() Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 12/23] sound: enable interrupt after dma buffer initialization Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 13/23] sound: don't call skl_init_chip() to reset intel skl soc Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 14/23] hv_netvsc: fix schedule in RCU context Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 15/23] stmmac: fix valid numbers of unicast filter entries Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 16/23] net: macb: disable scatter-gather for macb on sama5d3 Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 17/23] ARM: dts: at91: add new compatibility string " Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 18/23] PCI: hv: support reporting serial number as slot information Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 19/23] clk: x86: add "ether_clk" alias for Bay Trail / Cherry Trail Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 20/23] clk: x86: Stop marking clocks as CLK_IS_CRITICAL Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 21/23] x86/kvm/lapic: always disable MMIO interface in x2APIC mode Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 22/23] drm/amdgpu: Fix SDMA HQD destroy error on gfx_v7 Sasha Levin
2018-10-05 16:16 ` [PATCH AUTOSEL 4.14 23/23] ubifs: Check for name being NULL while mounting Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181005161634.20631-8-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=alexander.levin@microsoft.com \
    --cc=chenhuiz@axis.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.