From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751515AbcH3N0u (ORCPT ); Tue, 30 Aug 2016 09:26:50 -0400 Received: from down.free-electrons.com ([37.187.137.238]:56853 "EHLO mail.free-electrons.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1750766AbcH3N0s (ORCPT ); Tue, 30 Aug 2016 09:26:48 -0400 Date: Tue, 30 Aug 2016 15:26:43 +0200 From: Boris Brezillon To: Marcel Holtmann , Gustavo Padovan , Johan Hedberg , linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org, jason.abele@gmail.com Subject: Re: [PATCH 0/4] Bluetooth: hci_uart: various fixes Message-ID: <20160830152643.3a64de8b@bbrezillon> In-Reply-To: <1471592327-14133-1-git-send-email-boris.brezillon@free-electrons.com> References: <1471592327-14133-1-git-send-email-boris.brezillon@free-electrons.com> Organization: Free Electrons X-Mailer: Claws Mail 3.13.2 (GTK+ 2.24.30; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 19 Aug 2016 09:38:43 +0200 Boris Brezillon wrote: > Hi, > > We recently faced some problems when using an BT uart chip interfaced > through the H5 proto (rtk_h5). Here are the logs of the 2 different > issues we had when closing the line discipline (actually, restoring > the previous one) [1][2]. I know the kernel is Tainted in those logs, > but after some investigations I found a few potential issues that might > explain what we're seeing. > > Patches 1 and 2 are fixing 2 potential 'use after free' bugs: in some > (unlikely) cases the timer and work we try to cancel in the closing > path can be re-scheduled in our back, and since we're releasing the > memory region assigned to those elements at the end of the closing > procedure we can end-up with those invalid pointer exception when the > work or timer handler is called. > > Note that this problem is pretty hard to reproduce, so I'm not sure > my patches are fixing all the racy paths. > > Patches 3 and 4 are fixing potential issues that I didn't directly > face but may be worth fixing. Path 3 is fixing a potential double > free issue (proto->close() called twice if the hdev registration > failed). Patch 4 is making sure we don't loose some TX events. > > Let me know what you think. Ping. > > Thanks, > > Boris > > [1]http://code.bulix.org/8qtjly-105082 > [2]http://code.bulix.org/qzur9n-105083 > > > Boris Brezillon (4): > Bluetooth: hci_ldisc: fix a race in the hdev closing path > Bluetooth: hci_h5: fix a race in the closing path > Bluetooth: hci_ldisc: don't release resources in hci_uart_init_work() > Bluetooth: hci_ldisc: make sure we don't loose HCI_UART_TX_WAKEUP > events > > drivers/bluetooth/hci_h5.c | 7 ++++++- > drivers/bluetooth/hci_ldisc.c | 30 ++++++++++++++++++++++++++---- > drivers/bluetooth/hci_uart.h | 1 + > 3 files changed, 33 insertions(+), 5 deletions(-) >