From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Ole Bjørn Midtbø" <omidtbo@cisco.com>,
"Marcel Holtmann" <marcel@holtmann.org>,
"Sasha Levin" <sashal@kernel.org>
Subject: [PATCH 5.4 24/61] Bluetooth: hidp: use correct wait queue when removing ctrl_wait
Date: Tue, 24 Aug 2021 13:00:29 -0400 [thread overview]
Message-ID: <20210824170106.710221-25-sashal@kernel.org> (raw)
In-Reply-To: <20210824170106.710221-1-sashal@kernel.org>
From: Ole Bjørn Midtbø <omidtbo@cisco.com>
[ Upstream commit cca342d98bef68151a80b024f7bf5f388d1fbdea ]
A different wait queue was used when removing ctrl_wait than when adding
it. This effectively made the remove operation without locking compared
to other operations on the wait queue ctrl_wait was part of. This caused
issues like below where dead000000000100 is LIST_POISON1 and
dead000000000200 is LIST_POISON2.
list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \
but was dead000000000200. (next=ffffffc03ac77de0).
------------[ cut here ]------------
CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G O 4.4.238+ #9
...
---[ end trace 0adc2158f0646eac ]---
Call trace:
[<ffffffc000443f78>] __list_add+0x38/0xb0
[<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68
[<ffffffc00020eecc>] __pollwait+0xec/0x100
[<ffffffc000d1556c>] bt_sock_poll+0x74/0x200
[<ffffffc000bdb8a8>] sock_poll+0x110/0x128
[<ffffffc000210378>] do_sys_poll+0x220/0x480
[<ffffffc0002106f0>] SyS_poll+0x80/0x138
[<ffffffc00008510c>] __sys_trace_return+0x0/0x4
Unable to handle kernel paging request at virtual address dead000000000100
...
CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G W O 4.4.238+ #9
...
Call trace:
[<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8
[<ffffffc0000f0818>] __wake_up+0x50/0x70
[<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60
[<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224
[<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298
[<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198
[<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78
[<ffffffc000d29934>] hci_event_packet+0x564/0x2e30
[<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360
[<ffffffc0000c2218>] process_one_work+0x268/0x460
[<ffffffc0000c2678>] worker_thread+0x268/0x480
[<ffffffc0000c94e0>] kthread+0x118/0x128
[<ffffffc000085070>] ret_from_fork+0x10/0x20
---[ end trace 0adc2158f0646ead ]---
Signed-off-by: Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hidp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index bef84b95e2c4..ac98e3b37ab4 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1290,7 +1290,7 @@ static int hidp_session_thread(void *arg)
/* cleanup runtime environment */
remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
+ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
wake_up_interruptible(&session->report_queue);
hidp_del_timer(session);
--
2.30.2
next prev parent reply other threads:[~2021-08-24 17:16 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-24 17:00 [PATCH 5.4 00/61] 5.4.143-rc1 review Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 01/61] ext4: fix EXT4_MAX_LOGICAL_BLOCK macro Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 02/61] x86/fpu: Make init_fpstate correct with optimized XSAVE Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 03/61] ath: Use safer key clearing with key cache entries Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 04/61] ath9k: Clear key cache explicitly on disabling hardware Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 05/61] ath: Export ath_hw_keysetmac() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 06/61] ath: Modify ath_key_delete() to not need full key entry Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 07/61] ath9k: Postpone key cache entry deletion for TXQ frames reference it Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 08/61] mtd: cfi_cmdset_0002: fix crash when erasing/writing AMD cards Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 09/61] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 10/61] media: zr364xx: fix memory leaks in probe() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 11/61] media: drivers/media/usb: fix memory leak in zr364xx_probe Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 12/61] USB: core: Avoid WARNings for 0-length descriptor requests Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 13/61] dmaengine: xilinx_dma: Fix read-after-free bug when terminating transfers Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 14/61] dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 15/61] ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 16/61] dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller is not yet available Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 17/61] scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 18/61] scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 19/61] scsi: core: Avoid printing an error if target_alloc() returns -ENXIO Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 20/61] scsi: core: Fix capacity set to zero after offlinining device Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 21/61] ARM: dts: nomadik: Fix up interrupt controller node names Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 22/61] net: usb: lan78xx: don't modify phy_device state concurrently Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 23/61] drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X Sasha Levin
2021-08-24 17:00 ` Sasha Levin [this message]
2021-08-24 17:00 ` [PATCH 5.4 25/61] iommu: Check if group is NULL before remove device Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 26/61] cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 27/61] dccp: add do-while-0 stubs for dccp_pr_debug macros Sasha Levin
2021-08-24 17:00 ` Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 28/61] virtio: Protect vqs list access Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 29/61] vhost: Fix the calculation in vhost_overflow() Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 30/61] bpf: Clear zext_dst of dead insns Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 31/61] bnxt: don't lock the tx queue from napi poll Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 32/61] bnxt: disable napi before canceling DIM Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 33/61] net: 6pack: fix slab-out-of-bounds in decode_data Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 34/61] ptp_pch: Restore dependency on PCI Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 35/61] bnxt_en: Add missing DMA memory barriers Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 36/61] vrf: Reset skb conntrack connection on VRF rcv Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 37/61] virtio-net: support XDP when not more queues Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 38/61] virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 39/61] net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 40/61] net: mdio-mux: Don't ignore memory allocation errors Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 41/61] net: mdio-mux: Handle -EPROBE_DEFER correctly Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 42/61] ovs: clear skb->tstamp in forwarding path Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 43/61] i40e: Fix ATR queue selection Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 44/61] iavf: Fix ping is lost after untrusted VF had tried to change MAC Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 45/61] ovl: add splice file read write helper Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 46/61] mmc: dw_mmc: Fix hang on data CRC error Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 47/61] ALSA: hda - fix the 'Capture Switch' value change notifications Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 48/61] tracing / histogram: Fix NULL pointer dereference on strcmp() on NULL event name Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 49/61] slimbus: messaging: start transaction ids from 1 instead of zero Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 50/61] slimbus: messaging: check for valid transaction id Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 51/61] slimbus: ngd: reset dma setup during runtime pm Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 52/61] ipack: tpci200: fix many double free issues in tpci200_pci_probe Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 53/61] ipack: tpci200: fix memory leak in the tpci200_register Sasha Levin
2021-08-24 17:00 ` [PATCH 5.4 54/61] btrfs: prevent rename2 from exchanging a subvol with a directory from different parents Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 55/61] PCI: Increase D3 delay for AMD Renoir/Cezanne XHCI Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 56/61] ASoC: intel: atom: Fix breakage for PCM buffer address setup Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 57/61] mm, memcg: avoid stale protection values when cgroup is above protection Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 58/61] mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 59/61] fs: warn about impending deprecation of mandatory locks Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 60/61] netfilter: nft_exthdr: fix endianness of tcp option cast Sasha Levin
2021-08-24 17:01 ` [PATCH 5.4 61/61] Linux 5.4.143-rc1 Sasha Levin
2021-08-25 7:38 ` [PATCH 5.4 00/61] 5.4.143-rc1 review Samuel Zou
2021-08-25 13:03 ` Sudip Mukherjee
2021-08-25 14:25 ` Jon Hunter
2021-08-25 18:37 ` Daniel Díaz
2021-08-25 20:25 ` Guenter Roeck
2021-08-25 22:36 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210824170106.710221-25-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=omidtbo@cisco.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.