diff mbox series

[v1] Bluetooth: btintel: Attempt to reset if Read Version fail during setup

Message ID 20240401193515.2525201-1-luiz.dentz@gmail.com (mailing list archive)
State Superseded
Headers show
Series [v1] Bluetooth: btintel: Attempt to reset if Read Version fail during setup | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/CheckPatch success CheckPatch PASS
tedd_an/GitLint success Gitlint PASS
tedd_an/SubjectPrefix success Gitlint PASS
tedd_an/BuildKernel success BuildKernel PASS
tedd_an/CheckAllWarning success CheckAllWarning PASS
tedd_an/CheckSparse success CheckSparse PASS
tedd_an/CheckSmatch fail CheckSparse: FAIL: Segmentation fault (core dumped) make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139 make[4]: *** Deleting file 'net/bluetooth/hci_core.o' make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:485: net] Error 2 make[2]: *** Waiting for unfinished jobs.... Segmentation fault (core dumped) make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139 make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o' make[4]: *** Waiting for unfinished jobs.... make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2 make[2]: *** [scripts/Makefile.build:485: drivers] Error 2 make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2 make: *** [Makefile:240: __sub-make] Error 2
tedd_an/BuildKernel32 success BuildKernel32 PASS
tedd_an/TestRunnerSetup success TestRunnerSetup PASS
tedd_an/TestRunner_l2cap-tester success TestRunner PASS
tedd_an/TestRunner_iso-tester success TestRunner PASS
tedd_an/TestRunner_bnep-tester success TestRunner PASS
tedd_an/TestRunner_mgmt-tester fail TestRunner_mgmt-tester: Total: 492, Passed: 489 (99.4%), Failed: 1, Not Run: 2
tedd_an/TestRunner_rfcomm-tester success TestRunner PASS
tedd_an/TestRunner_sco-tester success TestRunner PASS
tedd_an/TestRunner_ioctl-tester success TestRunner PASS
tedd_an/TestRunner_mesh-tester success TestRunner PASS
tedd_an/TestRunner_smp-tester success TestRunner PASS
tedd_an/TestRunner_userchan-tester success TestRunner PASS
tedd_an/IncrementalBuild success Incremental Build PASS

Commit Message

Luiz Augusto von Dentz April 1, 2024, 7:35 p.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

During setup callback the code would attempt to send Read Version which
sometimes can fail due to ncmd being set to 0 which would block any
command from being send which is why INTEL_BROKEN_INITIAL_NCMD was
introduced.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 drivers/bluetooth/btintel.c | 47 +++++++++++++++++++++++--------------
 1 file changed, 30 insertions(+), 17 deletions(-)

Comments

bluez.test.bot@gmail.com April 1, 2024, 8:58 p.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=840347

---Test result---

Test Summary:
CheckPatch                    PASS      0.51 seconds
GitLint                       PASS      0.21 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      30.11 seconds
CheckAllWarning               PASS      32.99 seconds
CheckSparse                   PASS      38.45 seconds
CheckSmatch                   FAIL      35.93 seconds
BuildKernel32                 PASS      29.51 seconds
TestRunnerSetup               PASS      520.57 seconds
TestRunner_l2cap-tester       PASS      18.07 seconds
TestRunner_iso-tester         PASS      30.82 seconds
TestRunner_bnep-tester        PASS      4.87 seconds
TestRunner_mgmt-tester        FAIL      112.55 seconds
TestRunner_rfcomm-tester      PASS      7.38 seconds
TestRunner_sco-tester         PASS      12.96 seconds
TestRunner_ioctl-tester       PASS      7.76 seconds
TestRunner_mesh-tester        PASS      5.91 seconds
TestRunner_smp-tester         PASS      6.97 seconds
TestRunner_userchan-tester    PASS      4.96 seconds
IncrementalBuild              PASS      28.66 seconds

Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:

Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 492, Passed: 489 (99.4%), Failed: 1, Not Run: 2

Failed Test Cases
LL Privacy - Add Device 5 (2 Devices to RL)          Failed       0.172 seconds


---
Regards,
Linux Bluetooth
Manuel Mendez April 9, 2024, 12:56 p.m. UTC | #2 
On Mon, Apr 1, 2024, at 3:35 PM, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
> During setup callback the code would attempt to send Read Version which
> sometimes can fail due to ncmd being set to 0 which would block any
> command from being send which is why INTEL_BROKEN_INITIAL_NCMD was
> introduced.
>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  drivers/bluetooth/btintel.c | 47 +++++++++++++++++++++++--------------
>  1 file changed, 30 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
> index a19ebe47bd95..c2ebdd2b2462 100644
> --- a/drivers/bluetooth/btintel.c
> +++ b/drivers/bluetooth/btintel.c
> @@ -655,9 +655,6 @@ static int btintel_read_version_tlv(struct hci_dev *hdev,
>  	struct sk_buff *skb;
>  	const u8 param[1] = { 0xFF };
> 
> -	if (!version)
> -		return -EINVAL;
> -
>  	skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
>  	if (IS_ERR(skb)) {
>  		bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
> @@ -672,12 +669,38 @@ static int btintel_read_version_tlv(struct hci_dev *hdev,
>  		return -EIO;
>  	}
> 
> -	btintel_parse_version_tlv(hdev, version, skb);
> +	if (version)
> +		btintel_parse_version_tlv(hdev, version, skb);
> 
>  	kfree_skb(skb);
>  	return 0;
>  }
> 
> +static int btintel_read_version_setup(struct hci_dev *hdev)
> +{
> +	int err;
> +	struct sk_buff *skb;
> +
> +	err = btintel_read_version_tlv(hdev, NULL);
> +	if (!err)
> +		return 0;
> +
> +	/* Attempt to reset if the command times out since this could be
> +	 * because the ncmd is set to 0 therefore no command will be able to be
> +	 * sent.
> +	 */
> +	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
> +	if (IS_ERR(skb)) {
> +		bt_dev_err(hdev, "sending initial HCI reset failed (%ld)",
> +			   PTR_ERR(skb));
> +		return PTR_ERR(skb);
> +	}
> +
> +	kfree_skb(skb);
> +
> +	return btintel_read_version_tlv(hdev, NULL);
> +}
> +
>  /* ------- REGMAP IBT SUPPORT ------- */
> 
>  #define IBT_REG_MODE_8BIT  0x00
> @@ -2821,7 +2844,6 @@ static void btintel_print_fseq_info(struct hci_dev *hdev)
> 
>  static int btintel_setup_combined(struct hci_dev *hdev)
>  {
> -	const u8 param[1] = { 0xFF };
>  	struct intel_version ver;
>  	struct intel_version_tlv ver_tlv;
>  	struct sk_buff *skb;
> @@ -2862,18 +2884,9 @@ static int btintel_setup_combined(struct hci_dev *hdev)
>  	 * command has a parameter and returns a correct version information.
>  	 * So, it uses new format to support both legacy and new format.
>  	 */
> -	skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
> -	if (IS_ERR(skb)) {
> -		bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
> -			   PTR_ERR(skb));
> -		return PTR_ERR(skb);
> -	}
> -
> -	/* Check the status */
> -	if (skb->data[0]) {
> -		bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
> -			   skb->data[0]);
> -		err = -EIO;
> +	err = btintel_read_version_setup(hdev);
> +	if (err) {
> +		bt_dev_err(hdev, "Intel Read Version command failed (%d)", err);
>  		goto exit_error;
>  	}
...
After applying this patch skb is left as null here and I later get a null dereference oops on line 2753:
  if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 
...
> 
> -- 
> 2.44.0
diff mbox series

Patch

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index a19ebe47bd95..c2ebdd2b2462 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -655,9 +655,6 @@  static int btintel_read_version_tlv(struct hci_dev *hdev,
 	struct sk_buff *skb;
 	const u8 param[1] = { 0xFF };
 
-	if (!version)
-		return -EINVAL;
-
 	skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 	if (IS_ERR(skb)) {
 		bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
@@ -672,12 +669,38 @@  static int btintel_read_version_tlv(struct hci_dev *hdev,
 		return -EIO;
 	}
 
-	btintel_parse_version_tlv(hdev, version, skb);
+	if (version)
+		btintel_parse_version_tlv(hdev, version, skb);
 
 	kfree_skb(skb);
 	return 0;
 }
 
+static int btintel_read_version_setup(struct hci_dev *hdev)
+{
+	int err;
+	struct sk_buff *skb;
+
+	err = btintel_read_version_tlv(hdev, NULL);
+	if (!err)
+		return 0;
+
+	/* Attempt to reset if the command times out since this could be
+	 * because the ncmd is set to 0 therefore no command will be able to be
+	 * sent.
+	 */
+	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
+	if (IS_ERR(skb)) {
+		bt_dev_err(hdev, "sending initial HCI reset failed (%ld)",
+			   PTR_ERR(skb));
+		return PTR_ERR(skb);
+	}
+
+	kfree_skb(skb);
+
+	return btintel_read_version_tlv(hdev, NULL);
+}
+
 /* ------- REGMAP IBT SUPPORT ------- */
 
 #define IBT_REG_MODE_8BIT  0x00
@@ -2821,7 +2844,6 @@  static void btintel_print_fseq_info(struct hci_dev *hdev)
 
 static int btintel_setup_combined(struct hci_dev *hdev)
 {
-	const u8 param[1] = { 0xFF };
 	struct intel_version ver;
 	struct intel_version_tlv ver_tlv;
 	struct sk_buff *skb;
@@ -2862,18 +2884,9 @@  static int btintel_setup_combined(struct hci_dev *hdev)
 	 * command has a parameter and returns a correct version information.
 	 * So, it uses new format to support both legacy and new format.
 	 */
-	skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
-	if (IS_ERR(skb)) {
-		bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
-			   PTR_ERR(skb));
-		return PTR_ERR(skb);
-	}
-
-	/* Check the status */
-	if (skb->data[0]) {
-		bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
-			   skb->data[0]);
-		err = -EIO;
+	err = btintel_read_version_setup(hdev);
+	if (err) {
+		bt_dev_err(hdev, "Intel Read Version command failed (%d)", err);
 		goto exit_error;
 	}