| Message ID | 20221129092556.116222-1-chenzhongjin@huawei.com (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | Bluetooth: Fix not cleanup led when bt_init fails | expand |
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>: On Tue, 29 Nov 2022 17:25:56 +0800 you wrote: > bt_init() calls bt_leds_init() to register led, but if it fails later, > bt_leds_cleanup() is not called to unregister it. > > This can cause panic if the argument "bluetooth-power" in text is freed > and then another led_trigger_register() tries to access it: > > BUG: unable to handle page fault for address: ffffffffc06d3bc0 > RIP: 0010:strcmp+0xc/0x30 > Call Trace: > <TASK> > led_trigger_register+0x10d/0x4f0 > led_trigger_register_simple+0x7d/0x100 > bt_init+0x39/0xf7 [bluetooth] > do_one_initcall+0xd0/0x4e0 > > [...] Here is the summary with links: - Bluetooth: Fix not cleanup led when bt_init fails https://git.kernel.org/bluetooth/bluetooth-next/c/63d70ae785a9 You are awesome, thank you!
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index dc65974f5adb..1c3c7ff5c3c6 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -737,7 +737,7 @@ static int __init bt_init(void) err = bt_sysfs_init(); if (err < 0) - return err; + goto cleanup_led; err = sock_register(&bt_sock_family_ops); if (err) @@ -773,6 +773,8 @@ static int __init bt_init(void) sock_unregister(PF_BLUETOOTH); cleanup_sysfs: bt_sysfs_cleanup(); +cleanup_led: + bt_leds_cleanup(); return err; }
bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 Fixes: e64c97b53bc6 ("Bluetooth: Add combined LED trigger for controller power") Signed-off-by: Chen Zhongjin <chenzhongjin@huawei.com> --- net/bluetooth/af_bluetooth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)