Bluetooth: Fix hci_suspend_sync crash

Commit Message

Ying Hsu July 5, 2023, 9:06 p.m. UTC

If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier
may still be accessing it, it can cause the program to crash.
Here's the call trace:
  <4>[102152.653246] Call Trace:
  <4>[102152.653254]  hci_suspend_sync+0x109/0x301 [bluetooth]
  <4>[102152.653259]  hci_suspend_dev+0x78/0xcd [bluetooth]
  <4>[102152.653263]  hci_suspend_notifier+0x42/0x7a [bluetooth]
  <4>[102152.653268]  notifier_call_chain+0x43/0x6b
  <4>[102152.653271]  __blocking_notifier_call_chain+0x48/0x69
  <4>[102152.653273]  __pm_notifier_call_chain+0x22/0x39
  <4>[102152.653276]  pm_suspend+0x287/0x57c
  <4>[102152.653278]  state_store+0xae/0xe5
  <4>[102152.653281]  kernfs_fop_write+0x109/0x173
  <4>[102152.653284]  __vfs_write+0x16f/0x1a2
  <4>[102152.653287]  ? selinux_file_permission+0xca/0x16f
  <4>[102152.653289]  ? security_file_permission+0x36/0x109
  <4>[102152.653291]  vfs_write+0x114/0x21d
  <4>[102152.653293]  __x64_sys_write+0x7b/0xdb
  <4>[102152.653296]  do_syscall_64+0x59/0x194
  <4>[102152.653299]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1

This patch holds the reference count of the hci_dev object while
processing it in hci_suspend_notifier to avoid potential crash
caused by the race condition.

Signed-off-by: Ying Hsu <[e-mail]>
---
Tested with 100 times suspend/resume on a Chromebook device.

 net/bluetooth/hci_core.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

[e-mail] July 5, 2023, 9:41 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=762867

---Test result---

Test Summary:
CheckPatch                    PASS      0.67 seconds
GitLint                       PASS      0.31 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      40.45 seconds
CheckAllWarning               PASS      44.29 seconds
CheckSparse                   PASS      49.58 seconds
CheckSmatch                   PASS      134.53 seconds
BuildKernel32                 PASS      38.85 seconds
TestRunnerSetup               PASS      594.80 seconds
TestRunner_l2cap-tester       PASS      28.84 seconds
TestRunner_iso-tester         PASS      63.10 seconds
TestRunner_bnep-tester        PASS      13.19 seconds
TestRunner_mgmt-tester        PASS      256.80 seconds
TestRunner_rfcomm-tester      PASS      20.28 seconds
TestRunner_sco-tester         PASS      20.72 seconds
TestRunner_ioctl-tester       PASS      22.56 seconds
TestRunner_mesh-tester        PASS      16.72 seconds
TestRunner_smp-tester         PASS      17.53 seconds
TestRunner_userchan-tester    PASS      14.28 seconds
IncrementalBuild              PASS      37.29 seconds



---
Regards,
Linux Bluetooth

[e-mail] July 13, 2023, 8:10 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Wed,  5 Jul 2023 21:06:47 +0000 you wrote:
> If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier
> may still be accessing it, it can cause the program to crash.
> Here's the call trace:
>   <4>[102152.653246] Call Trace:
>   <4>[102152.653254]  hci_suspend_sync+0x109/0x301 [bluetooth]
>   <4>[102152.653259]  hci_suspend_dev+0x78/0xcd [bluetooth]
>   <4>[102152.653263]  hci_suspend_notifier+0x42/0x7a [bluetooth]
>   <4>[102152.653268]  notifier_call_chain+0x43/0x6b
>   <4>[102152.653271]  __blocking_notifier_call_chain+0x48/0x69
>   <4>[102152.653273]  __pm_notifier_call_chain+0x22/0x39
>   <4>[102152.653276]  pm_suspend+0x287/0x57c
>   <4>[102152.653278]  state_store+0xae/0xe5
>   <4>[102152.653281]  kernfs_fop_write+0x109/0x173
>   <4>[102152.653284]  __vfs_write+0x16f/0x1a2
>   <4>[102152.653287]  ? selinux_file_permission+0xca/0x16f
>   <4>[102152.653289]  ? security_file_permission+0x36/0x109
>   <4>[102152.653291]  vfs_write+0x114/0x21d
>   <4>[102152.653293]  __x64_sys_write+0x7b/0xdb
>   <4>[102152.653296]  do_syscall_64+0x59/0x194
>   <4>[102152.653299]  entry_SYSCALL_64_after_hwframe+0x5c/0xc1
> 
> [...]

Here is the summary with links:
  - Bluetooth: Fix hci_suspend_sync crash
    https://git.kernel.org/bluetooth/bluetooth-next/c/0c9bf63ad8ca

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index b421e196f60c..bdbe26ffbd39 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2434,6 +2434,9 @@  static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
 		return NOTIFY_DONE;
 
+	/* To avoid a potential race with hci_unregister_dev. */
+	hci_dev_hold(hdev);
+
 	if (action == PM_SUSPEND_PREPARE)
 		ret = hci_suspend_dev(hdev);
 	else if (action == PM_POST_SUSPEND)
@@ -2443,6 +2446,7 @@  static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
 		bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
 			   action, ret);
 
+	hci_dev_put(hdev);
 	return NOTIFY_DONE;
 }