mirror of
https://github.com/torvalds/linux.git
synced 2024-12-15 23:51:46 +00:00
272970be3d
The driver shutdown callback (which sends EDL_SOC_RESET to the device
over serdev) should not be invoked when HCI device is not open (e.g. if
hci_dev_open_sync() failed), because the serdev and its TTY are not open
either. Also skip this step if device is powered off
(qca_power_shutdown()).
The shutdown callback causes use-after-free during system reboot with
Qualcomm Atheros Bluetooth:
Unable to handle kernel paging request at virtual address
0072662f67726fd7
...
CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W
6.1.0-rt5-00325-g8a5f56bcfcca #8
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Call trace:
tty_driver_flush_buffer+0x4/0x30
serdev_device_write_flush+0x24/0x34
qca_serdev_shutdown+0x80/0x130 [hci_uart]
device_shutdown+0x15c/0x260
kernel_restart+0x48/0xac
KASAN report:
BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50
Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1
CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted
6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28
Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)
Call trace:
dump_backtrace.part.0+0xdc/0xf0
show_stack+0x18/0x30
dump_stack_lvl+0x68/0x84
print_report+0x188/0x488
kasan_report+0xa4/0xf0
__asan_load8+0x80/0xac
tty_driver_flush_buffer+0x1c/0x50
ttyport_write_flush+0x34/0x44
serdev_device_write_flush+0x48/0x60
qca_serdev_shutdown+0x124/0x274
device_shutdown+0x1e8/0x350
kernel_restart+0x48/0xb0
__do_sys_reboot+0x244/0x2d0
__arm64_sys_reboot+0x54/0x70
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x44/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xbc/0x140
el0t_64_sync+0x190/0x194
Fixes:
|
||
---|---|---|
.. | ||
ath3k.c | ||
bcm203x.c | ||
bfusb.c | ||
bluecard_cs.c | ||
bpa10x.c | ||
bt3c_cs.c | ||
btbcm.c | ||
btbcm.h | ||
btintel.c | ||
btintel.h | ||
btmrvl_debugfs.c | ||
btmrvl_drv.h | ||
btmrvl_main.c | ||
btmrvl_sdio.c | ||
btmrvl_sdio.h | ||
btmtk.c | ||
btmtk.h | ||
btmtksdio.c | ||
btmtkuart.c | ||
btqca.c | ||
btqca.h | ||
btqcomsmd.c | ||
btrsi.c | ||
btrtl.c | ||
btrtl.h | ||
btsdio.c | ||
btusb.c | ||
dtl1_cs.c | ||
h4_recv.h | ||
hci_ag6xx.c | ||
hci_ath.c | ||
hci_bcm4377.c | ||
hci_bcm.c | ||
hci_bcsp.c | ||
hci_h4.c | ||
hci_h5.c | ||
hci_intel.c | ||
hci_ldisc.c | ||
hci_ll.c | ||
hci_mrvl.c | ||
hci_nokia.c | ||
hci_qca.c | ||
hci_serdev.c | ||
hci_uart.h | ||
hci_vhci.c | ||
Kconfig | ||
Makefile | ||
virtio_bt.c |