From patchwork Fri Nov 17 19:28:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manish Mandlik X-Patchwork-Id: 744722 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="PEG1Ry6b" Received: from mail-pf1-x449.google.com (mail-pf1-x449.google.com [IPv6:2607:f8b0:4864:20::449]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85005D4F for ; Fri, 17 Nov 2023 11:29:43 -0800 (PST) Received: by mail-pf1-x449.google.com with SMTP id d2e1a72fcca58-6b74afe92dbso2776177b3a.1 for ; Fri, 17 Nov 2023 11:29:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1700249383; x=1700854183; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=7ZtpR5VBZnnk4soDSw6IwamiHkMHtshmq2RkQ7zs14Y=; b=PEG1Ry6bk3xe23gXUeibAY60PYqMqIFQf5RkDsat2en1DIbkh8m+ExE0T7nNCW/4EE ZtoQPu/C4Lr8jLphqOa2txNnNCcBLZiTb5a/hy7W/1mMc7K+6TfVMtrRm9oOhtb4rh/W BA+vmEo9J4FkbYXB39b4Ookem5y3SoNnl3ANXMRt4YeH7WTW/tXp2/0s4lBiNehtqYoX XAsTVliTDHixJb05WFDWVWyp7CwBKo/Fuf2MNU9GC/ClnI9WeYcNpkDOYuWmWJVyep06 7ioEMhSJ2br8iHgdkNLbBBlBX4CACOEUo8RjNwPsz6VOlMKlrPTrIQhkUOT34g51crBk Jvrg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700249383; x=1700854183; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=7ZtpR5VBZnnk4soDSw6IwamiHkMHtshmq2RkQ7zs14Y=; b=Y0/4HD2DQt8qyOOkU63GwR9g09/zx2duEE4KJoAg1rvY9XR/0BapWtN2g1x4iEIqln xM5HlTPvXe+4EcfakLnAkKY/yVP8+euTbrWe5JZxW/80g5vxzEZ3dxwF8tTLYmV1qvVO SVGGUsS50kZfU1jVbBGP+KQ9L/vLIdq9LHGDuk2M547+14+qAiIrv37LAKb5O1qQXpBb X3qIcbRwJUs3W0VS+f62yvfiOuUURVkvysFkNZfNtbo0g5kYzbi3yjd88/vHRH5w11zG TahsNqihiPyDY3TYsDmsdCrtt1Tzi1vk0X6b7H6CGwfieJinj5hjmerPmQASfeSPnxPJ vcKQ== X-Gm-Message-State: AOJu0YwM2/mfqpthwNT2R4cBSG/1NaVy6L1tDwrbVl1dmpzzO5AeAC2M QQ466aCDcWSoJsrzOWSiUc+08FUeOLmJ7w== X-Google-Smtp-Source: AGHT+IFslrvPLsq4BT5PcXEkzGg0ZUVP85qVwKubrphQcon4Mwiuor6/RqEk3QS/vc3/a5OeGoXksoaO5xM7Cw== X-Received: from mmandlik-cloudtop.c.googlers.com ([fda3:e722:ac3:cc00:24:72f4:c0a8:2893]) (user=mmandlik job=sendgmr) by 2002:a05:6a00:8d93:b0:6c6:b762:ad83 with SMTP id im19-20020a056a008d9300b006c6b762ad83mr112843pfb.0.1700249382992; Fri, 17 Nov 2023 11:29:42 -0800 (PST) Date: Fri, 17 Nov 2023 11:28:33 -0800 Precedence: bulk X-Mailing-List: linux-bluetooth@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.43.0.rc0.421.g78406f8d94-goog Message-ID: <20231117112833.v2.1.I4c7ab22148e168e3cde00f27b89748ff4bc651c2@changeid> Subject: [PATCH v2 1/2] Bluetooth: btusb: Return when coredump trigger cmd fails From: Manish Mandlik To: marcel@holtmann.org, luiz.dentz@gmail.com Cc: chromeos-bluetooth-upstreaming@chromium.org, linux-bluetooth@vger.kernel.org, Manish Mandlik , Johan Hedberg , Tim Jiang , linux-kernel@vger.kernel.org Avoid freeing NULL skb when hci command fails. Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support") Signed-off-by: Manish Mandlik --- Changes in v2: - Fixed a typo in error log in btusb_coredump_qca() drivers/bluetooth/btusb.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index b8e9de887b5d..35a26440cabd 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3463,8 +3463,11 @@ static void btusb_coredump_qca(struct hci_dev *hdev) struct sk_buff *skb; skb = __hci_cmd_sync(hdev, 0xfc0c, 1, param, HCI_CMD_TIMEOUT); - if (IS_ERR(skb)) - bt_dev_err(hdev, "%s: triggle crash failed (%ld)", __func__, PTR_ERR(skb)); + if (IS_ERR(skb)) { + bt_dev_err(hdev, "%s: trigger crash failed (%ld)", __func__, PTR_ERR(skb)); + return; + } + kfree_skb(skb); } From patchwork Fri Nov 17 19:28:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Manish Mandlik X-Patchwork-Id: 745225 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="v40S9pXS" Received: from mail-pg1-x549.google.com (mail-pg1-x549.google.com [IPv6:2607:f8b0:4864:20::549]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2145DD4E for ; Fri, 17 Nov 2023 11:29:47 -0800 (PST) Received: by mail-pg1-x549.google.com with SMTP id 41be03b00d2f7-5bdfc1bb3eeso3738843a12.1 for ; Fri, 17 Nov 2023 11:29:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1700249386; x=1700854186; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=7BLtURhc1ohq6G7Ehb9fNj26PZtAiF6i6XyPfX0SmPQ=; b=v40S9pXSOHQ6tKdCq7miQ1egRBEA72FQZnxTRJ1jtcOTjnOyKgTQUuN75Qzh3DF+eG yzCBflI1AcAVzOtYcnUEsbScZTQo5cOiqUMT1rZWraE+jO9FepwduneKooLVF0mKAcdg 5M/57Lx99Ld34M8EY0cj7arxbbWOcX+ZCR2ZvO+k6LWAbcnyd5BVLSxptDV7De5YBD1x U48B6iQx3bNyG1wOOOlHQghZCQPR1o7slfP++mBGM1HdfZJxL5qWPILPa+ly2+LoJUi0 3J9xTiyyM3jt/C89EPqqk4ahh64qa/wsSDXgUloi0AUu4ooingvJY5TbzjgukvFI08Od Pq0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700249386; x=1700854186; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=7BLtURhc1ohq6G7Ehb9fNj26PZtAiF6i6XyPfX0SmPQ=; b=H3wpFQxjQjRTYW4oQDn780m29VMCnCOB0oEhFozFLfWbTzveKGRCeYq7JshbyS9t09 LeDv+zD/hvfv1YU3laBDR5XxawpUs1X+Mz65rBF7tWuj5x1s9UA/VkAZPgyEkASkZb10 XRR0ulldcLNM9V+EWo24T6VNHBSBqRaQ2SWTlHLuw0G+qNXmKRG8BEare/5i/xar6NDZ UPeN1KlWid933DgTJLRRFv6rjCaDLa6Qe4w2RaLK9pwTZE95bIghcUiuI3Z3Y+SN9/MW 3KGx1so9kAEH45MM1vl94hXru3CI5IyIliqgIH7orJRjgjN4nzKvakNQvJ5kgjKYOH8J 3k4w== X-Gm-Message-State: AOJu0Yy+K3aQZrsL4LKR3sCAxSJJFBimf7GDgpL5H32YQLj0Y5OAONCy fApfWnwmlmZJWLput3ZZdC7kcHxT5ZZ2Ag== X-Google-Smtp-Source: AGHT+IHPOmLYguT+8vb5GwUDrc+ZP4ecu7SsbJuI3BcLECKsyV3gfi+SPO2WAh3jllf3e2TWKANI9fc+O0t1hA== X-Received: from mmandlik-cloudtop.c.googlers.com ([fda3:e722:ac3:cc00:24:72f4:c0a8:2893]) (user=mmandlik job=sendgmr) by 2002:a17:90a:bd97:b0:280:c3df:e29f with SMTP id z23-20020a17090abd9700b00280c3dfe29fmr2081pjr.3.1700249386621; Fri, 17 Nov 2023 11:29:46 -0800 (PST) Date: Fri, 17 Nov 2023 11:28:34 -0800 In-Reply-To: <20231117112833.v2.1.I4c7ab22148e168e3cde00f27b89748ff4bc651c2@changeid> Precedence: bulk X-Mailing-List: linux-bluetooth@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20231117112833.v2.1.I4c7ab22148e168e3cde00f27b89748ff4bc651c2@changeid> X-Mailer: git-send-email 2.43.0.rc0.421.g78406f8d94-goog Message-ID: <20231117112833.v2.2.I5f8211e201324f6d9f699e995fc59dda1e51f0ce@changeid> Subject: [PATCH v2 2/2] Bluetooth: btusb: Fix double free in handle_dump_pkt_qca() From: Manish Mandlik To: marcel@holtmann.org, luiz.dentz@gmail.com Cc: chromeos-bluetooth-upstreaming@chromium.org, linux-bluetooth@vger.kernel.org, Manish Mandlik , Johan Hedberg , Tim Jiang , linux-kernel@vger.kernel.org The hci_devcd_init() returns 0 on success. Do not use this return value when eturning from handle_dump_pkt_qca() as it incorrectly indicates that it's not a dump packet. This causes the first dump skb to be processed by both hci_devcd_rx() and hci_recv_frame() leading to double free. Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support") Signed-off-by: Manish Mandlik --- (no changes since v1) drivers/bluetooth/btusb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 35a26440cabd..d23c992502c5 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3531,10 +3531,11 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) goto out; } - ret = hci_devcd_init(hdev, dump_size); - if (ret < 0) { - bt_dev_err(hdev, "memdump init error(%d)", ret); - goto out; + if (hci_devcd_init(hdev, dump_size) < 0) { + bt_dev_err(hdev, "memdump init error"); + clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags); + kfree_skb(skb); + return ret; } btdata->qca_dump.ram_dump_size = dump_size;