From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: "Ole Bjørn Midtbø" <omidtbo@cisco.com>,
"Marcel Holtmann" <marcel@holtmann.org>,
"Sasha Levin" <sashal@kernel.org>,
linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.19 19/87] Bluetooth: hidp: use correct wait queue when removing ctrl_wait
Date: Tue, 22 Dec 2020 21:19:55 -0500 [thread overview]
Message-ID: <20201223022103.2792705-19-sashal@kernel.org> (raw)
In-Reply-To: <20201223022103.2792705-1-sashal@kernel.org>
From: Ole Bjørn Midtbø <omidtbo@cisco.com>
[ Upstream commit cca342d98bef68151a80b024f7bf5f388d1fbdea ]
A different wait queue was used when removing ctrl_wait than when adding
it. This effectively made the remove operation without locking compared
to other operations on the wait queue ctrl_wait was part of. This caused
issues like below where dead000000000100 is LIST_POISON1 and
dead000000000200 is LIST_POISON2.
list_add corruption. next->prev should be prev (ffffffc1b0a33a08), \
but was dead000000000200. (next=ffffffc03ac77de0).
------------[ cut here ]------------
CPU: 3 PID: 2138 Comm: bluetoothd Tainted: G O 4.4.238+ #9
...
---[ end trace 0adc2158f0646eac ]---
Call trace:
[<ffffffc000443f78>] __list_add+0x38/0xb0
[<ffffffc0000f0d04>] add_wait_queue+0x4c/0x68
[<ffffffc00020eecc>] __pollwait+0xec/0x100
[<ffffffc000d1556c>] bt_sock_poll+0x74/0x200
[<ffffffc000bdb8a8>] sock_poll+0x110/0x128
[<ffffffc000210378>] do_sys_poll+0x220/0x480
[<ffffffc0002106f0>] SyS_poll+0x80/0x138
[<ffffffc00008510c>] __sys_trace_return+0x0/0x4
Unable to handle kernel paging request at virtual address dead000000000100
...
CPU: 4 PID: 5387 Comm: kworker/u15:3 Tainted: G W O 4.4.238+ #9
...
Call trace:
[<ffffffc0000f079c>] __wake_up_common+0x7c/0xa8
[<ffffffc0000f0818>] __wake_up+0x50/0x70
[<ffffffc000be11b0>] sock_def_wakeup+0x58/0x60
[<ffffffc000de5e10>] l2cap_sock_teardown_cb+0x200/0x224
[<ffffffc000d3f2ac>] l2cap_chan_del+0xa4/0x298
[<ffffffc000d45ea0>] l2cap_conn_del+0x118/0x198
[<ffffffc000d45f8c>] l2cap_disconn_cfm+0x6c/0x78
[<ffffffc000d29934>] hci_event_packet+0x564/0x2e30
[<ffffffc000d19b0c>] hci_rx_work+0x10c/0x360
[<ffffffc0000c2218>] process_one_work+0x268/0x460
[<ffffffc0000c2678>] worker_thread+0x268/0x480
[<ffffffc0000c94e0>] kthread+0x118/0x128
[<ffffffc000085070>] ret_from_fork+0x10/0x20
---[ end trace 0adc2158f0646ead ]---
Signed-off-by: Ole Bjørn Midtbø <omidtbo@cisco.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hidp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 253975cce943e..0cbd0bca971ff 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -1282,7 +1282,7 @@ static int hidp_session_thread(void *arg)
/* cleanup runtime environment */
remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
- remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
+ remove_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
wake_up_interruptible(&session->report_queue);
hidp_del_timer(session);
--
2.27.0
next prev parent reply other threads:[~2020-12-23 2:22 UTC|newest]
Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 2:19 [PATCH AUTOSEL 4.19 01/87] locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 02/87] tomoyo: fix clang pointer arithmetic warning Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 03/87] crypto: omap-aes - fix the reference count leak of omap device Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 04/87] staging: wimax: depends on NET Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 05/87] scsi: pm80xx: Avoid busywait in FW ready check Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 06/87] scsi: pm80xx: Fix pm8001_mpi_get_nvmd_resp() race condition Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 07/87] fcntl: Fix potential deadlock in send_sig{io, urg}() Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 08/87] staging: ks7010: fix missing destroy_workqueue() on error in ks7010_sdio_probe Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 09/87] staging: rtl8192u: fix wrong judgement in rtl8192_rx_isr Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 10/87] mips: ar7: add missing iounmap() on error in ar7_gpio_init Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 11/87] mips: cm: add missing iounmap() on error in mips_cm_probe() Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 12/87] locktorture: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 13/87] torture: Prevent jitter processes from delaying failed run Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 14/87] rcutorture: Prevent hangs for invalid arguments Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 15/87] rsi: Fix TX EAPOL packet handling against iwlwifi AP Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 16/87] drm: panel: simple: add missing platform_driver_unregister() in panel_simple_init Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 17/87] drm/ast: Fixed 1920x1080 sync. polarity issue Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 18/87] s390/trng: set quality to 1024 Sasha Levin
2020-12-23 2:19 ` Sasha Levin [this message]
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 20/87] net: skb_vlan_untag(): don't reset transport offset if set by GRO layer Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 21/87] drm/omap: Fix runtime PM imbalance on error Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 22/87] mwifiex: pcie: skip cancel_work_sync() on reset failure path Sasha Levin
2020-12-23 2:19 ` [PATCH AUTOSEL 4.19 23/87] MIPS: BMC47xx: fix kconfig dependency bug for BCM47XX_SSB Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 24/87] net: ipconfig: Avoid spurious blank lines in boot log Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 25/87] jfs: Fix memleak in dbAdjCtl Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 26/87] media: zr364xx: propagate errors from zr364xx_start_readpipe() Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 27/87] media: cec-core: first mark device unregistered, then wake up fhs Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 28/87] media: isif: reset global state Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 29/87] s390/dasd: Fix operational path inconsistency Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 30/87] media: usb: dvb-usb-v2: zd1301: fix missing platform_device_unregister() Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 31/87] media: dvbdev: Fix memleak in dvb_register_device Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 32/87] mmc: tmio: do not print real IOMEM pointer Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 33/87] ARM: OMAP2+: Fix memleak in omap2xxx_clkt_vps_init Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 34/87] MIPS: kvm: Use vm_get_page_prot to get protection bits Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 35/87] scsi: ufs: Atomic update for clkgating_enable Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 36/87] Bluetooth: hci_h5: Add OBDA0623 ACPI HID Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 37/87] ALSA: usb-audio: Don't call usb_set_interface() at trigger callback Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 38/87] rxrpc: Don't leak the service-side session key to userspace Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 39/87] scsi: atari_scsi: Fix race condition between .queuecommand and EH Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 40/87] ARM: dts: hisilicon: fix errors detected by snps-dw-apb-uart.yaml Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 41/87] ARM: dts: hisilicon: fix errors detected by pl011.yaml Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 42/87] ARM: dts: hisilicon: fix errors detected by usb yaml Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 43/87] ARM: dts: hisilicon: fix errors detected by simple-bus.yaml Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 44/87] ARM: dts: hisilicon: fix errors detected by spi-pl022.yaml Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 45/87] selftests/x86/fsgsbase: Fix GS == 1, 2, and 3 tests Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 46/87] brcmsmac: ampdu: Check BA window size before checking block ack Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 47/87] i40e: report correct VF link speed when link state is set to enable Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 48/87] hv_netvsc: Validate number of allocated sub-channels Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 49/87] iommu/tegra-smmu: Expand mutex protection range Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 50/87] HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 51/87] arm64: tegra: Fix GIC400 missing GICH/GICV register regions Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 52/87] crypto: qce - Fix SHA result buffer corruption issues Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 53/87] media: gp8psk: initialize stats at power control logic Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 54/87] net/lapb: fix t1 timer handling for LAPB_STATE_0 Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 55/87] x86/pci: Fix the function type for check_reserved_t Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 56/87] x86/mce: Panic for LMCE only if mca_cfg.tolerant < 3 Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 57/87] bridge: switchdev: Notify about VLAN protocol changes Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 58/87] media: cx23885: add more quirks for reset DMA on some AMD IOMMU Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 59/87] tty/serial/imx: Enable TXEN bit in imx_poll_init() Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 60/87] MIPS: KASLR: Avoid endless loop in sync_icache if synci_step is zero Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 61/87] ALSA: rawmidi: Access runtime->avail always in spinlock Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 62/87] cpufreq: sti-cpufreq: fix mem leak in sti_cpufreq_set_opp_info() Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 63/87] cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 64/87] media: rcar-vin: Mask VNCSI_IFMD register Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 65/87] clocksource/drivers/sh_cmt: Fix potential deadlock when calling runtime PM Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 66/87] mwifiex: Fix possible buffer overflows in mwifiex_cmd_802_11_ad_hoc_start Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 67/87] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140 Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 68/87] ARM: zynq: Fix leds subnode name for zc702/zybo-z7 Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 69/87] btrfs: fix race leading to unnecessary transaction commit when logging inode Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 70/87] driver core: Reorder devices on successful probe Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 71/87] misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 72/87] iwlwifi: pcie: validate RX descriptor length Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 73/87] iwlwifi: trans: consider firmware dead after errors Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 74/87] iwlwifi: add an extra firmware state in the transport Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 75/87] USB: typec: tcpm: Fix PR_SWAP error handling Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 76/87] USB: typec: tcpm: Add a 30ms room for tPSSourceOn in PR_SWAP Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 77/87] nl80211: always accept scan request with the duration set Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 78/87] cfg80211: Save the regulatory domain when setting custom regulatory Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 79/87] mac80211: disallow band-switch during CSA Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 80/87] mac80211: support Rx timestamp calculation for all preamble types Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 81/87] mac80211: use bitfield helpers for BA session action frames Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 82/87] mac80211: Fix calculation of minimal channel width Sasha Levin
2020-12-23 2:20 ` [PATCH AUTOSEL 4.19 83/87] mac80211: don't filter out beacons once we start CSA Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.19 84/87] mac80211: Update rate control on channel change Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.19 85/87] ALSA: hda/hdmi: packet buffer index must be set before reading value Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.19 86/87] cdrom: Reset sector_size back it is not 2048 Sasha Levin
2020-12-23 2:21 ` [PATCH AUTOSEL 4.19 87/87] PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223022103.2792705-19-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=netdev@vger.kernel.org \
--cc=omidtbo@cisco.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome