Hi Christophe,
On Fri, Jan 5, 2024 at 2:15 AM Christophe JAILLET
<christophe.jaillet@xxxxxxxxxx> wrote:
>
> Le 04/01/2024 à 12:56, Ying Hsu a écrit :
> > While handling the HCI_EV_HARDWARE_ERROR event, if the underlying
> > BT controller is not responding, the GPIO reset mechanism would
> > free the hci_dev and lead to a use-after-free in hci_error_reset.
> >
> > Here's the call trace observed on a ChromeOS device with Intel AX201:
> > queue_work_on+0x3e/0x6c
> > __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>]
> > ? init_wait_entry+0x31/0x31
> > __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>]
> > hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>]
> > process_one_work+0x1d8/0x33f
> > worker_thread+0x21b/0x373
> > kthread+0x13a/0x152
> > ? pr_cont_work+0x54/0x54
> > ? kthread_blkcg+0x31/0x31
> > ret_from_fork+0x1f/0x30
> >
> > This patch holds the reference count on the hci_dev while processing
> > a HCI_EV_HARDWARE_ERROR event to avoid potential crash.
> >
> > Signed-off-by: Ying Hsu <yinghsu-F7+t8E8rja9g9hUCZPvPmw@xxxxxxxxxxxxxxxx>
> > ---
> > Tested this commit on a chromebook with Intel BT controller.
> >
> > net/bluetooth/hci_core.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> > index 65601aa52e0d..a42417926028 100644
> > --- a/net/bluetooth/hci_core.c
> > +++ b/net/bluetooth/hci_core.c
> > @@ -1049,6 +1049,7 @@ static void hci_error_reset(struct work_struct *work)
> > {
> > struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
> >
> > + hci_dev_hold(hdev);
> > BT_DBG("%s", hdev->name);
> >
> > if (hdev->hw_error)
> > @@ -1060,6 +1061,7 @@ static void hci_error_reset(struct work_struct *work)
> > return;
>
> ^^^^^
> Should we also call hci_dev_put() if we hit this return?
Yep, I will fix that since Ive already pushed to bluetooth-next.
>
> CJ
>
> >
> > hci_dev_do_open(hdev);
> > + hci_dev_put(hdev);
> > }
> >
> > void hci_uuids_clear(struct hci_dev *hdev)
>
--
Luiz Augusto von Dentz
