All of lore.kernel.org
 help / color / mirror / Atom feed
From: Marcel Holtmann <marcel@holtmann.org>
To: Howard Chung <howardchung@google.com>
Cc: Bluetooth Kernel Mailing List <linux-bluetooth@vger.kernel.org>,
	Miao-chen Chou <mcchou@chromium.org>,
	Manish Mandlik <mmandlik@chromium.org>,
	Archie Pusaka <apusaka@chromium.org>,
	"David S. Miller" <davem@davemloft.net>,
	Jakub Kicinski <kuba@kernel.org>,
	Johan Hedberg <johan.hedberg@gmail.com>,
	Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
	LKML <linux-kernel@vger.kernel.org>,
	netdev@vger.kernel.org
Subject: Re: [PATCH v1] Bluetooth: Fix crash in mgmt_add_adv_patterns_monitor_complete
Date: Wed, 3 Feb 2021 14:33:32 +0100	[thread overview]
Message-ID: <FF91258F-2875-4569-9195-6321409DFEA6@holtmann.org> (raw)
In-Reply-To: <20210203150907.v1.1.I23ab3f91f23508bf84908e62d470bfab1d844f63@changeid>

Hi Howard,

> If hci_add_adv_monitor is a pending command(e.g. forward to
> msft_add_monitor_pattern), it is possible that
> mgmt_add_adv_patterns_monitor_complete gets called before
> cmd->user_data gets set, which will cause a crash when we
> try to get the moniter handle through cmd->user_data in
> mgmt_add_adv_patterns_monitor_complete.
> 
> This moves the cmd->user_data assignment earlier than
> hci_add_adv_monitor.
> 
> RIP: 0010:mgmt_add_adv_patterns_monitor_complete+0x82/0x187 [bluetooth]
> Code: 1e bf 03 00 00 00 be 52 00 00 00 4c 89 ea e8 9e
> e4 02 00 49 89 c6 48 85 c0 0f 84 06 01 00 00 48 89 5d b8 4c 89 fb 4d 8b
> 7e 30 <41> 0f b7 47 18 66 89 45 c0 45 84 e4 75 5a 4d 8b 56 28 48 8d 4d
> c8
> RSP: 0018:ffffae81807dbcb8 EFLAGS: 00010286
> RAX: ffff91c4bdf723c0 RBX: 0000000000000000 RCX: ffff91c4e5da5b80
> RDX: ffff91c405680000 RSI: 0000000000000052 RDI: ffff91c49d654c00
> RBP: ffffae81807dbd00 R08: ffff91c49fb157e0 R09: ffff91c49fb157e0
> R10: 000000000002a4f0 R11: ffffffffc0819cfd R12: 0000000000000000
> R13: ffff91c405680000 R14: ffff91c4bdf723c0 R15: 0000000000000000
> FS:  0000000000000000(0000) GS:ffff91c4ea300000(0000)
> knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000018 CR3: 0000000133612002 CR4:
> 00000000003606e0
> Call Trace:
> ? msft_le_monitor_advertisement_cb+0x111/0x141
> [bluetooth]
> hci_event_packet+0x425e/0x631c [bluetooth]
> ? printk+0x59/0x73
> ? __switch_to_asm+0x41/0x70
> ?
> msft_le_set_advertisement_filter_enable_cb+0xa6/0xa6 [bluetooth]
> ? bt_dbg+0xb4/0xbb [bluetooth]
> ? __switch_to_asm+0x41/0x70
> hci_rx_work+0x101/0x319 [bluetooth]
> process_one_work+0x257/0x506
> worker_thread+0x10d/0x284
> kthread+0x14c/0x154
> ? process_one_work+0x506/0x506
> ? kthread_blkcg+0x2c/0x2c
> ret_from_fork+0x1f/0x40
> 
> Reviewed-by: Miao-chen Chou <mcchou@chromium.org>
> Reviewed-by: Manish Mandlik <mmandlik@chromium.org>
> Reviewed-by: Archie Pusaka <apusaka@chromium.org>
> Signed-off-by: Howard Chung <howardchung@google.com>
> ---
> 
> net/bluetooth/mgmt.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel


      parent reply	other threads:[~2021-02-03 13:38 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-03  7:09 [PATCH v1] Bluetooth: Fix crash in mgmt_add_adv_patterns_monitor_complete Howard Chung
2021-02-03  8:13 ` [v1] " bluez.test.bot
2021-02-03 13:33 ` Marcel Holtmann [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=FF91258F-2875-4569-9195-6321409DFEA6@holtmann.org \
    --to=marcel@holtmann.org \
    --cc=apusaka@chromium.org \
    --cc=davem@davemloft.net \
    --cc=howardchung@google.com \
    --cc=johan.hedberg@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luiz.dentz@gmail.com \
    --cc=mcchou@chromium.org \
    --cc=mmandlik@chromium.org \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.