diff mbox series

[1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

Message ID 20220919175700.1649726-1-luiz.dentz@gmail.com (mailing list archive)
State Accepted
Commit 448a496f760664d3e2e79466aa1787e6abc922b5
Headers show
Series [1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/checkpatch success Checkpatch PASS
tedd_an/gitlint fail [1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times 37: B1 Line exceeds max length (83>80): "Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a"
tedd_an/subjectprefix success PASS
tedd_an/buildkernel success Build Kernel PASS
tedd_an/buildkernel32 success Build Kernel32 PASS
tedd_an/incremental_build success Pass
tedd_an/testrunnersetup success Test Runner Setup PASS
tedd_an/testrunnerl2cap-tester success Total: 40, Passed: 40 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunneriso-tester success Total: 55, Passed: 55 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnerbnep-tester success Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnermgmt-tester success Total: 494, Passed: 494 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnerrfcomm-tester success Total: 11, Passed: 11 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnersco-tester success Total: 12, Passed: 12 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunnersmp-tester success Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0
tedd_an/testrunneruserchan-tester success Total: 4, Passed: 4 (100.0%), Failed: 0, Not Run: 0

Commit Message

Luiz Augusto von Dentz Sept. 19, 2022, 5:56 p.m. UTC
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

device_add shall not be called multiple times as stated in its
documentation:

 'Do not call this routine or device_register() more than once for
 any device structure'

Syzkaller reports a bug as follows [1]:
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:33!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
[...]
Call Trace:
 <TASK>
 __list_add include/linux/list.h:69 [inline]
 list_add_tail include/linux/list.h:102 [inline]
 kobj_kset_join lib/kobject.c:164 [inline]
 kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
 kobject_add_varg lib/kobject.c:358 [inline]
 kobject_add+0x150/0x1c0 lib/kobject.c:410
 device_add+0x368/0x1e90 drivers/base/core.c:3452
 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
 hci_event_func net/bluetooth/hci_event.c:7440 [inline]
 hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/hci_sysfs.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

bluez.test.bot@gmail.com Sept. 19, 2022, 6:22 p.m. UTC | #1
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=678331

---Test result---

Test Summary:
CheckPatch                    PASS      3.63 seconds
GitLint                       FAIL      1.07 seconds
SubjectPrefix                 PASS      1.70 seconds
BuildKernel                   PASS      36.19 seconds
BuildKernel32                 PASS      31.49 seconds
Incremental Build with patchesPASS      50.95 seconds
TestRunner: Setup             PASS      509.27 seconds
TestRunner: l2cap-tester      PASS      17.28 seconds
TestRunner: iso-tester        PASS      16.25 seconds
TestRunner: bnep-tester       PASS      6.65 seconds
TestRunner: mgmt-tester       PASS      103.96 seconds
TestRunner: rfcomm-tester     PASS      10.30 seconds
TestRunner: sco-tester        PASS      9.75 seconds
TestRunner: smp-tester        PASS      9.83 seconds
TestRunner: userchan-tester   PASS      6.76 seconds

Details
##############################
Test: GitLint - FAIL - 1.07 seconds
Run gitlint with rule in .gitlint
[1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
37: B1 Line exceeds max length (83>80): "Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a"




---
Regards,
Linux Bluetooth
Hawkins Jiawei Sept. 21, 2022, 5:50 a.m. UTC | #2
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> device_add shall not be called multiple times as stated in its
> documentation:
> 
>  'Do not call this routine or device_register() more than once for
>  any device structure'
> 
> Syzkaller reports a bug as follows [1]:
> ------------[ cut here ]------------
> kernel BUG at lib/list_debug.c:33!
> invalid opcode: 0000 [#1] PREEMPT SMP KASAN
> [...]
> Call Trace:
>  <TASK>
>  __list_add include/linux/list.h:69 [inline]
>  list_add_tail include/linux/list.h:102 [inline]
>  kobj_kset_join lib/kobject.c:164 [inline]
>  kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214
>  kobject_add_varg lib/kobject.c:358 [inline]
>  kobject_add+0x150/0x1c0 lib/kobject.c:410
>  device_add+0x368/0x1e90 drivers/base/core.c:3452
>  hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53
>  hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799
>  hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110
>  hci_event_func net/bluetooth/hci_event.c:7440 [inline]
>  hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495
>  hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007
>  process_one_work+0x991/0x1610 kernel/workqueue.c:2289
>  worker_thread+0x665/0x1080 kernel/workqueue.c:2436
>  kthread+0x2e4/0x3a0 kernel/kthread.c:376
>  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
>  </TASK>
> 
> Link: https://syzkaller.appspot.com/bug?id=da3246e2d33afdb92d66bc166a0934c5b146404a
I tried the reproducer from syzkaller, and it didn't trigger any issues.
And I also tryied multiple HCI_LE_CIS_Estabilished events, still normal.

Test-by: Hawkins Jiawei <yin31149@gmail.com>

> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  net/bluetooth/hci_sysfs.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
> index 4e3e0451b08c..08542dfc2dc5 100644
> --- a/net/bluetooth/hci_sysfs.c
> +++ b/net/bluetooth/hci_sysfs.c
> @@ -48,6 +48,9 @@ void hci_conn_add_sysfs(struct hci_conn *conn)
>  
>  	BT_DBG("conn %p", conn);
>  
> +	if (device_is_registered(&conn->dev))
> +		return;
> +
>  	dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
>  
>  	if (device_add(&conn->dev) < 0) {
> -- 
> 2.37.3
patchwork-bot+bluetooth@kernel.org Sept. 21, 2022, 10:10 p.m. UTC | #3
Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon, 19 Sep 2022 10:56:59 -0700 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> device_add shall not be called multiple times as stated in its
> documentation:
> 
>  'Do not call this routine or device_register() more than once for
>  any device structure'
> 
> [...]

Here is the summary with links:
  - [1/2] Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
    https://git.kernel.org/bluetooth/bluetooth-next/c/448a496f7606
  - [2/2] Bluetooth: hci_debugfs: Fix not checking conn->debugfs
    https://git.kernel.org/bluetooth/bluetooth-next/c/7096daba731e

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 4e3e0451b08c..08542dfc2dc5 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -48,6 +48,9 @@  void hci_conn_add_sysfs(struct hci_conn *conn)
 
 	BT_DBG("conn %p", conn);
 
+	if (device_is_registered(&conn->dev))
+		return;
+
 	dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
 	if (device_add(&conn->dev) < 0) {