Hi Krzysztof,
On Thu, Jan 12, 2023 at 7:20 AM Krzysztof Kozlowski
<krzysztof.kozlowski@xxxxxxxxxx> wrote:
>
> On 29/12/2022 11:28, Krzysztof Kozlowski wrote:
> > The driver shutdown callback (which sends EDL_SOC_RESET to the device
> > over serdev) should not be invoked when HCI device is not open (e.g. if
> > hci_dev_open_sync() failed), because the serdev and its TTY are not open
> > either. Also skip this step if device is powered off
> > (qca_power_shutdown()).
> >
> > The shutdown callback causes use-after-free during system reboot with
> > Qualcomm Atheros Bluetooth:
> >
> > Unable to handle kernel paging request at virtual address 0072662f67726fd7
> > ...
> > CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W 6.1.0-rt5-00325-g8a5f56bcfcca #8
> > Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
> > Call trace:
> > tty_driver_flush_buffer+0x4/0x30
> > serdev_device_write_flush+0x24/0x34
> > qca_serdev_shutdown+0x80/0x130 [hci_uart]
> > device_shutdown+0x15c/0x260
> > kernel_restart+0x48/0xac
> >
> > KASAN report:
> >
> > BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50
> > Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1
> >
> > CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28
> > Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
> > Call trace:
> > dump_backtrace.part.0+0xdc/0xf0
> > show_stack+0x18/0x30
> > dump_stack_lvl+0x68/0x84
> > print_report+0x188/0x488
> > kasan_report+0xa4/0xf0
> > __asan_load8+0x80/0xac
> > tty_driver_flush_buffer+0x1c/0x50
> > ttyport_write_flush+0x34/0x44
> > serdev_device_write_flush+0x48/0x60
> > qca_serdev_shutdown+0x124/0x274
> > device_shutdown+0x1e8/0x350
> > kernel_restart+0x48/0xb0
> > __do_sys_reboot+0x244/0x2d0
> > __arm64_sys_reboot+0x54/0x70
> > invoke_syscall+0x60/0x190
> > el0_svc_common.constprop.0+0x7c/0x160
> > do_el0_svc+0x44/0xf0
> > el0_svc+0x2c/0x6c
> > el0t_64_sync_handler+0xbc/0x140
> > el0t_64_sync+0x190/0x194
> >
> > Fixes: 7e7bbddd029b ("Bluetooth: hci_qca: Fix qca6390 enable failure after warm reboot")
> > Cc: <stable@xxxxxxxxxxxxxxx>
> > Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxx>
> >
> > ---
>
> Any comments on this? Patchwork tools complain on longer line, but
> without it checkpatch would complain as well, so I assume you do not
> expect to fix it?
I did apply it already:
https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=a18fca670e14f0c09c2ed332cf2c6d77a4ae05f9
Not sure why the bot hasn't responded to you.
> Best regards,
> Krzysztof
>
--
Luiz Augusto von Dentz
