lkml.org 
[lkml]   [2016]   [Aug]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 0/4] Bluetooth: hci_uart: various fixes
On Fri, 19 Aug 2016 09:38:43 +0200
Boris Brezillon <boris.brezillon@free-electrons.com> wrote:

> Hi,
>
> We recently faced some problems when using an BT uart chip interfaced
> through the H5 proto (rtk_h5). Here are the logs of the 2 different
> issues we had when closing the line discipline (actually, restoring
> the previous one) [1][2]. I know the kernel is Tainted in those logs,
> but after some investigations I found a few potential issues that might
> explain what we're seeing.
>
> Patches 1 and 2 are fixing 2 potential 'use after free' bugs: in some
> (unlikely) cases the timer and work we try to cancel in the closing
> path can be re-scheduled in our back, and since we're releasing the
> memory region assigned to those elements at the end of the closing
> procedure we can end-up with those invalid pointer exception when the
> work or timer handler is called.
>
> Note that this problem is pretty hard to reproduce, so I'm not sure
> my patches are fixing all the racy paths.
>
> Patches 3 and 4 are fixing potential issues that I didn't directly
> face but may be worth fixing. Path 3 is fixing a potential double
> free issue (proto->close() called twice if the hdev registration
> failed). Patch 4 is making sure we don't loose some TX events.
>
> Let me know what you think.

Ping.

>
> Thanks,
>
> Boris
>
> [1]http://code.bulix.org/8qtjly-105082
> [2]http://code.bulix.org/qzur9n-105083
>
>
> Boris Brezillon (4):
> Bluetooth: hci_ldisc: fix a race in the hdev closing path
> Bluetooth: hci_h5: fix a race in the closing path
> Bluetooth: hci_ldisc: don't release resources in hci_uart_init_work()
> Bluetooth: hci_ldisc: make sure we don't loose HCI_UART_TX_WAKEUP
> events
>
> drivers/bluetooth/hci_h5.c | 7 ++++++-
> drivers/bluetooth/hci_ldisc.c | 30 ++++++++++++++++++++++++++----
> drivers/bluetooth/hci_uart.h | 1 +
> 3 files changed, 33 insertions(+), 5 deletions(-)
>

\
 
 \ /
  Last update: 2016-09-17 09:58    [W:0.105 / U:0.268 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site