Thread (2 messages) flat view 2 messages, 2 authors, 2021-11-16

Re: [PATCH v3] Bluetooth: Don't initialize msft/aosp when using user channel

From: Marcel Holtmann <marcel@holtmann.org>
Date: 2021-11-16 14:00:07
Also in: linux-bluetooth, lkml

Hi Jesse,
A race condition is triggered when usermode control is given to
userspace before the kernel's MSFT query responds, resulting in an
unexpected response to userspace's reset command.

Issue can be observed in btmon:
< HCI Command: Vendor (0x3f|0x001e) plen 2                    #3 [hci0]
       05 01                                            ..
@ USER Open: bt_stack_manage (privileged) version 2.22  {0x0002} [hci0]
< HCI Command: Reset (0x03|0x0003) plen 0                     #4 [hci0]
quoted
HCI Event: Command Complete (0x0e) plen 5                   #5 [hci0]
     Vendor (0x3f|0x001e) ncmd 1
	Status: Command Disallowed (0x0c)
	05                                               .
quoted
HCI Event: Command Complete (0x0e) plen 4                   #6 [hci0]
     Reset (0x03|0x0003) ncmd 2
	Status: Success (0x00)
Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@chromium.org>
Reviewed-by: Sonny Sasaka <redacted>
Signed-off-by: Jesse Melhuish <redacted>
---

Changes in v3:
- Added guard around *_close calls as well.

Changes in v2:
- Moved guard to the new home for this code.

net/bluetooth/hci_sync.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
patch has been applied to bluetooth-next tree.

Regards

Marcel
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help