mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-30 22:03:17 +01:00
Weiming Shi
d236517c26
hci_devcd_handle_pkt_init() arms dump_timeout and coredump producers
queue dump_rx without holding an hdev reference. Unregister leaves both
works live, so disconnecting during an active dump lets them access hdev
after hci_release_dev() frees it.
Shut down coredump processing during unregister. Close the producer gate
under dump_q.lock before disabling both works, then free the active buffer
and queued packets under hci_dev_lock. Serializing the gate with enqueue
prevents controller-specific workers from adding packets after the final
purge.
Fixes: 9695ef876f ("Bluetooth: Add support for hci devcoredump")
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=b170dbf55520ebf5969a
Reported-by: Aby Sam Ross <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Suggested-by: Aby Sam Ross <[email protected]>
Reported-by: Tristan Madani <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reported-by: Xiang Mei <[email protected]>
Assisted-by: OpenAI Codex:gpt-5
Signed-off-by: Weiming Shi <[email protected]>
Reported-by: Xiang Mei <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
133 lines
3.5 KiB
C
133 lines
3.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (C) 2022 Google Corporation
|
|
*/
|
|
|
|
#ifndef __COREDUMP_H
|
|
#define __COREDUMP_H
|
|
|
|
#define DEVCOREDUMP_TIMEOUT msecs_to_jiffies(10000) /* 10 sec */
|
|
|
|
/*
|
|
* Max header size, shared by both the devcoredump core and
|
|
* the dmp_hdr() registered by driver via hci_devcd_register()
|
|
*/
|
|
#define HCI_DEVCD_HDR_SIZE_MAX 512
|
|
#define HCI_DEVCD_HDR_END_MARKER "--- Start dump ---\n"
|
|
|
|
typedef void (*coredump_t)(struct hci_dev *hdev);
|
|
typedef void (*dmp_hdr_t)(struct hci_dev *hdev, struct sk_buff *skb);
|
|
typedef void (*notify_change_t)(struct hci_dev *hdev, int state);
|
|
|
|
/* struct hci_devcoredump - Devcoredump state
|
|
*
|
|
* @supported: Indicates if FW dump collection is supported by driver
|
|
* @state: Current state of dump collection
|
|
* @timeout: Indicates a timeout for collecting the devcoredump
|
|
*
|
|
* @alloc_size: Total size of the dump
|
|
* @head: Start of the dump
|
|
* @tail: Pointer to current end of dump
|
|
* @end: head + alloc_size for easy comparisons
|
|
*
|
|
* @dump_q: Dump queue for state machine to process
|
|
* @dump_rx: Devcoredump state machine work
|
|
* @dump_timeout: Devcoredump timeout work
|
|
*
|
|
* @coredump: Called from the driver's .coredump() function.
|
|
* @dmp_hdr: Create a dump header to identify controller/fw/driver info
|
|
* @notify_change: Notify driver when devcoredump state has changed
|
|
*/
|
|
struct hci_devcoredump {
|
|
bool supported;
|
|
|
|
enum devcoredump_state {
|
|
HCI_DEVCOREDUMP_IDLE,
|
|
HCI_DEVCOREDUMP_ACTIVE,
|
|
HCI_DEVCOREDUMP_DONE,
|
|
HCI_DEVCOREDUMP_ABORT,
|
|
HCI_DEVCOREDUMP_TIMEOUT,
|
|
} state;
|
|
|
|
unsigned long timeout;
|
|
|
|
size_t alloc_size;
|
|
char *head;
|
|
char *tail;
|
|
char *end;
|
|
|
|
struct sk_buff_head dump_q;
|
|
struct work_struct dump_rx;
|
|
struct delayed_work dump_timeout;
|
|
|
|
coredump_t coredump;
|
|
dmp_hdr_t dmp_hdr;
|
|
notify_change_t notify_change;
|
|
};
|
|
|
|
#ifdef CONFIG_DEV_COREDUMP
|
|
|
|
const char *hci_devcd_state_name(enum devcoredump_state state);
|
|
|
|
void hci_devcd_reset(struct hci_dev *hdev);
|
|
void hci_devcd_shutdown(struct hci_dev *hdev);
|
|
void hci_devcd_rx(struct work_struct *work);
|
|
void hci_devcd_timeout(struct work_struct *work);
|
|
|
|
int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump,
|
|
dmp_hdr_t dmp_hdr, notify_change_t notify_change);
|
|
int hci_devcd_init(struct hci_dev *hdev, u32 dump_size);
|
|
int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb);
|
|
int hci_devcd_append_pattern(struct hci_dev *hdev, u8 pattern, u32 len);
|
|
int hci_devcd_complete(struct hci_dev *hdev);
|
|
int hci_devcd_abort(struct hci_dev *hdev);
|
|
|
|
#else
|
|
|
|
static inline const char *hci_devcd_state_name(enum devcoredump_state state)
|
|
{
|
|
return "";
|
|
}
|
|
|
|
static inline void hci_devcd_reset(struct hci_dev *hdev) {}
|
|
static inline void hci_devcd_shutdown(struct hci_dev *hdev) {}
|
|
static inline void hci_devcd_rx(struct work_struct *work) {}
|
|
static inline void hci_devcd_timeout(struct work_struct *work) {}
|
|
|
|
static inline int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump,
|
|
dmp_hdr_t dmp_hdr,
|
|
notify_change_t notify_change)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int hci_devcd_append_pattern(struct hci_dev *hdev,
|
|
u8 pattern, u32 len)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int hci_devcd_complete(struct hci_dev *hdev)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int hci_devcd_abort(struct hci_dev *hdev)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
#endif /* CONFIG_DEV_COREDUMP */
|
|
|
|
#endif /* __COREDUMP_H */
|