Bluetooth: cancel devcoredump work during device teardown
Subsystems (3)
PATCH 1/1 Bluetooth: cancel devcoredump work during device teardown
From: Tristan Madani <[email protected]>
hci_devcd_setup() initializes dump_timeout and dump_rx work items during device allocation, but hci_unregister_dev() does not cancel them before the device is freed. If a devcoredump is in progress when the device is unregistered, the dump_timeout delayed work timer remains active. When it fires after hci_release_dev() frees the hci_dev struct, it accesses freed memory.
Add hci_devcd_destroy() to disable dump work items and purge the dump queue, called from hci_unregister_dev() alongside the existing disable_work_sync() calls.
--- include/net/bluetooth/hci_core.h | 9 +++++++++ net/bluetooth/hci_core.c | 2 ++ 2 files changed, 11 insertions(+)
include/net/bluetooth/hci_core.h +9 -0
@@ -1800,6 +1800,15 @@ static inline void hci_devcd_setup(struct hci_dev *hdev)#endif } +static inline void hci_devcd_destroy (struct hci_dev *hdev) +{ +#ifdef CONFIG_DEV_COREDUMP +disable_delayed_work_sync (&hdev->dump.dump_timeout); +disable_work_sync (&hdev->dump.dump_rx); +skb_queue_purge (&hdev->dump.dump_q); +#endif +} +int hci_dev_open (__u16 dev);int hci_dev_close (__u16 dev);int hci_dev_do_close (struct hci_dev *hdev);
net/bluetooth/hci_core.c +2 -0
@@ -2671,6 +2671,8 @@ void hci_unregister_dev(struct hci_dev *hdev)disable_delayed_work_sync (&hdev->cmd_timer);disable_delayed_work_sync (&hdev->ncmd_timer); +hci_devcd_destroy (hdev); +hci_cmd_sync_clear (hdev);hci_unregister_suspend_notifier (hdev);
Signature · 1 line
2.47.3
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1146338
---Test result---
Test Summary:
CheckPatch PASS 0.96 seconds VerifyFixes PASS 0.14 seconds VerifySignedoff PASS 0.13 seconds GitLint PASS 0.38 seconds SubjectPrefix PASS 0.13 seconds BuildKernel PASS 26.69 seconds CheckAllWarning PASS 29.23 seconds CheckSparse PASS 27.66 seconds BuildKernel32 PASS 25.10 seconds CheckKernelLLVM SKIP 0.00 seconds TestRunnerSetup PASS 480.86 seconds TestRunner_l2cap-tester PASS 71.48 seconds TestRunner_iso-tester PASS 99.99 seconds TestRunner_bnep-tester PASS 19.79 seconds TestRunner_mgmt-tester FAIL 223.16 seconds TestRunner_rfcomm-tester PASS 26.10 seconds TestRunner_sco-tester PASS 32.03 seconds TestRunner_ioctl-tester PASS 27.21 seconds TestRunner_mesh-tester FAIL 27.50 seconds TestRunner_smp-tester PASS 24.00 seconds TestRunner_userchan-tester PASS 20.60 seconds TestRunner_6lowpan-tester PASS 24.45 seconds IncrementalBuild PASS 24.51 seconds
Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis Output:
Clang not found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 501, Passed: 496 (99.0%), Failed: 1, Not Run: 4
Failed Test Cases
Read Exp Feature - Success Failed 0.252 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 2.704 seconds Mesh - Send cancel - 2 Timed out 1.980 seconds
https://github.com/bluez/bluetooth-next/pull/585
---
Regards,
Linux Bluetooth
Luiz Augusto von Dentz
maintainerHi Tristan,
Quoted 56 lines · Tristan Madani
From: Tristan Madani <[email protected]>
hci_devcd_setup()initializesdump_timeoutanddump_rxwork items during device allocation, buthci_unregister_dev()does not cancel them before the device is freed. If a devcoredump is in progress when the device is unregistered, thedump_timeoutdelayed work timer remains active. When it fires afterhci_release_dev()frees thehci_devstruct, it accesses freed memory.Add
hci_devcd_destroy()to disable dump work items and purge the dump queue, called fromhci_unregister_dev()alongside the existingdisable_work_sync()calls.Fixes 9695ef876fd1 ("Bluetooth: Add support for hci devcoredump")Signed-off-by Tristan Madani <[email protected]>--- include/net/bluetooth/hci_core.h | 9 +++++++++ net/bluetooth/hci_core.c | 2 ++ 2 files changed, 11 insertions(+)include/net/bluetooth/hci_core.h +9
-0@@ -1800,6 +1800,15 @@ static inline void hci_devcd_setup(struct hci_dev *hdev)#endif } +static inline void hci_devcd_destroy (struct hci_dev *hdev) +{ +#ifdef CONFIG_DEV_COREDUMP +disable_delayed_work_sync (&hdev->dump.dump_timeout); +disable_work_sync (&hdev->dump.dump_rx); +skb_queue_purge (&hdev->dump.dump_q); +#endif +} +int hci_dev_open (__u16 dev);int hci_dev_close (__u16 dev);int hci_dev_do_close (struct hci_dev *hdev);net/bluetooth/hci_core.c +2
-1@@ -2671,6 +2671,8 @@ void hci_unregister_dev(struct hci_dev *hdev)disable_delayed_work_sync (&hdev->cmd_timer);disable_delayed_work_sync (&hdev->ncmd_timer); +hci_devcd_destroy (hdev); +hci_cmd_sync_clear (hdev);hci_unregister_suspend_notifier (hdev); --
Quoted 1 line
2.47.3
Sashiko found 2 issues, both seem valid to me:
https://sashiko.dev/#/patchset/20260814182849.940976-1-ali%40iusegentoo.com
Signature · 1 line
Luiz Augusto von Dentz