|
Takashi Iwai |
4175e3 |
From 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
4175e3 |
From: Archie Pusaka <apusaka@chromium.org>
|
|
Takashi Iwai |
4175e3 |
Date: Mon, 22 Mar 2021 14:02:15 +0800
|
|
Takashi Iwai |
4175e3 |
Subject: [PATCH] Bluetooth: Set CONF_NOT_COMPLETE as l2cap_chan default
|
|
Takashi Iwai |
4175e3 |
Git-commit: 3a9d54b1947ecea8eea9a902c0b7eb58a98add8a
|
|
Takashi Iwai |
4175e3 |
Patch-mainline: v5.13-rc1
|
|
Takashi Iwai |
4175e3 |
References: git-fixes
|
|
Takashi Iwai |
4175e3 |
|
|
Takashi Iwai |
4175e3 |
Currently l2cap_chan_set_defaults() reset chan->conf_state to zero.
|
|
Takashi Iwai |
4175e3 |
However, there is a flag CONF_NOT_COMPLETE which is set when
|
|
Takashi Iwai |
4175e3 |
creating the l2cap_chan. It is suggested that the flag should be
|
|
Takashi Iwai |
4175e3 |
cleared when l2cap_chan is ready, but when l2cap_chan_set_defaults()
|
|
Takashi Iwai |
4175e3 |
is called, l2cap_chan is not yet ready. Therefore, we must set this
|
|
Takashi Iwai |
4175e3 |
flag as the default.
|
|
Takashi Iwai |
4175e3 |
|
|
Takashi Iwai |
4175e3 |
Example crash call trace:
|
|
Takashi Iwai |
4175e3 |
__dump_stack lib/dump_stack.c:15 [inline]
|
|
Takashi Iwai |
4175e3 |
dump_stack+0xc4/0x118 lib/dump_stack.c:56
|
|
Takashi Iwai |
4175e3 |
panic+0x1c6/0x38b kernel/panic.c:117
|
|
Takashi Iwai |
4175e3 |
__warn+0x170/0x1b9 kernel/panic.c:471
|
|
Takashi Iwai |
4175e3 |
warn_slowpath_fmt+0xc7/0xf8 kernel/panic.c:494
|
|
Takashi Iwai |
4175e3 |
debug_print_object+0x175/0x193 lib/debugobjects.c:260
|
|
Takashi Iwai |
4175e3 |
debug_object_assert_init+0x171/0x1bf lib/debugobjects.c:614
|
|
Takashi Iwai |
4175e3 |
debug_timer_assert_init kernel/time/timer.c:629 [inline]
|
|
Takashi Iwai |
4175e3 |
debug_assert_init kernel/time/timer.c:677 [inline]
|
|
Takashi Iwai |
4175e3 |
del_timer+0x7c/0x179 kernel/time/timer.c:1034
|
|
Takashi Iwai |
4175e3 |
try_to_grab_pending+0x81/0x2e5 kernel/workqueue.c:1230
|
|
Takashi Iwai |
4175e3 |
cancel_delayed_work+0x7c/0x1c4 kernel/workqueue.c:2929
|
|
Takashi Iwai |
4175e3 |
l2cap_clear_timer+0x1e/0x41 include/net/bluetooth/l2cap.h:834
|
|
Takashi Iwai |
4175e3 |
l2cap_chan_del+0x2d8/0x37e net/bluetooth/l2cap_core.c:640
|
|
Takashi Iwai |
4175e3 |
l2cap_chan_close+0x532/0x5d8 net/bluetooth/l2cap_core.c:756
|
|
Takashi Iwai |
4175e3 |
l2cap_sock_shutdown+0x806/0x969 net/bluetooth/l2cap_sock.c:1174
|
|
Takashi Iwai |
4175e3 |
l2cap_sock_release+0x64/0x14d net/bluetooth/l2cap_sock.c:1217
|
|
Takashi Iwai |
4175e3 |
__sock_release+0xda/0x217 net/socket.c:580
|
|
Takashi Iwai |
4175e3 |
sock_close+0x1b/0x1f net/socket.c:1039
|
|
Takashi Iwai |
4175e3 |
__fput+0x322/0x55c fs/file_table.c:208
|
|
Takashi Iwai |
4175e3 |
____fput+0x17/0x19 fs/file_table.c:244
|
|
Takashi Iwai |
4175e3 |
task_work_run+0x19b/0x1d3 kernel/task_work.c:115
|
|
Takashi Iwai |
4175e3 |
exit_task_work include/linux/task_work.h:21 [inline]
|
|
Takashi Iwai |
4175e3 |
do_exit+0xe4c/0x204a kernel/exit.c:766
|
|
Takashi Iwai |
4175e3 |
do_group_exit+0x291/0x291 kernel/exit.c:891
|
|
Takashi Iwai |
4175e3 |
get_signal+0x749/0x1093 kernel/signal.c:2396
|
|
Takashi Iwai |
4175e3 |
do_signal+0xa5/0xcdb arch/x86/kernel/signal.c:737
|
|
Takashi Iwai |
4175e3 |
exit_to_usermode_loop arch/x86/entry/common.c:243 [inline]
|
|
Takashi Iwai |
4175e3 |
prepare_exit_to_usermode+0xed/0x235 arch/x86/entry/common.c:277
|
|
Takashi Iwai |
4175e3 |
syscall_return_slowpath+0x3a7/0x3b3 arch/x86/entry/common.c:348
|
|
Takashi Iwai |
4175e3 |
int_ret_from_sys_call+0x25/0xa3
|
|
Takashi Iwai |
4175e3 |
|
|
Takashi Iwai |
4175e3 |
Signed-off-by: Archie Pusaka <apusaka@chromium.org>
|
|
Takashi Iwai |
4175e3 |
Reported-by: syzbot+338f014a98367a08a114@syzkaller.appspotmail.com
|
|
Takashi Iwai |
4175e3 |
Reviewed-by: Alain Michaud <alainm@chromium.org>
|
|
Takashi Iwai |
4175e3 |
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
|
|
Takashi Iwai |
4175e3 |
Reviewed-by: Guenter Roeck <groeck@chromium.org>
|
|
Takashi Iwai |
4175e3 |
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
|
|
Takashi Iwai |
4175e3 |
Acked-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
4175e3 |
|
|
Takashi Iwai |
4175e3 |
---
|
|
Takashi Iwai |
4175e3 |
net/bluetooth/l2cap_core.c | 2 ++
|
|
Takashi Iwai |
4175e3 |
1 file changed, 2 insertions(+)
|
|
Takashi Iwai |
4175e3 |
|
|
Takashi Iwai |
4175e3 |
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
|
|
Takashi Iwai |
4175e3 |
index 374cc32d7138..59ab9689b37d 100644
|
|
Takashi Iwai |
4175e3 |
--- a/net/bluetooth/l2cap_core.c
|
|
Takashi Iwai |
4175e3 |
+++ b/net/bluetooth/l2cap_core.c
|
|
Takashi Iwai |
4175e3 |
@@ -516,7 +516,9 @@ void l2cap_chan_set_defaults(struct l2cap_chan *chan)
|
|
Takashi Iwai |
4175e3 |
chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
|
|
Takashi Iwai |
4175e3 |
chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
|
|
Takashi Iwai |
4175e3 |
chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
|
|
Takashi Iwai |
4175e3 |
+
|
|
Takashi Iwai |
4175e3 |
chan->conf_state = 0;
|
|
Takashi Iwai |
4175e3 |
+ set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
|
|
Takashi Iwai |
4175e3 |
|
|
Takashi Iwai |
4175e3 |
set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
|
|
Takashi Iwai |
4175e3 |
}
|
|
Takashi Iwai |
4175e3 |
--
|
|
Takashi Iwai |
4175e3 |
2.26.2
|
|
Takashi Iwai |
4175e3 |
|