Bluetooth: HCI: fix divide error in __get_blocks()

Commit Message

Sungwoo Kim May 6, 2024, 2:20 a.m. UTC

hdev->block_len could be 0. Fix this by adding a check.

divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G        W          6.9.0-rc6-00001-g38e1170f515d-dirty #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci11 hci_tx_work
RIP: 0010:__get_blocks net/bluetooth/hci_core.c:3618 [inline]
RIP: 0010:hci_sched_acl_blk net/bluetooth/hci_core.c:3766 [inline]
RIP: 0010:hci_sched_acl net/bluetooth/hci_core.c:3806 [inline]
RIP: 0010:hci_tx_work+0x73e/0x1d10 net/bluetooth/hci_core.c:3901

Fixes: b71d385a18cd ("Bluetooth: Recalculate sched HCI blk/pkt flow ctrl")
Signed-off-by: Sungwoo Kim <[e-mail]>
---
 net/bluetooth/hci_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

[e-mail] May 6, 2024, 2:46 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=850652

---Test result---

Test Summary:
CheckPatch                    FAIL      1.13 seconds
GitLint                       FAIL      0.54 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      30.07 seconds
CheckAllWarning               PASS      32.76 seconds
CheckSparse                   PASS      38.40 seconds
CheckSmatch                   FAIL      36.66 seconds
BuildKernel32                 PASS      28.71 seconds
TestRunnerSetup               PASS      517.65 seconds
TestRunner_l2cap-tester       PASS      18.30 seconds
TestRunner_iso-tester         PASS      30.58 seconds
TestRunner_bnep-tester        PASS      4.68 seconds
TestRunner_mgmt-tester        FAIL      110.53 seconds
TestRunner_rfcomm-tester      PASS      7.24 seconds
TestRunner_sco-tester         PASS      13.00 seconds
TestRunner_ioctl-tester       PASS      7.60 seconds
TestRunner_mesh-tester        PASS      5.80 seconds
TestRunner_smp-tester         PASS      6.78 seconds
TestRunner_userchan-tester    PASS      4.92 seconds
IncrementalBuild              PASS      29.55 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: HCI: fix divide error in __get_blocks()
WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#83: 
CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G        W          6.9.0-rc6-00001-g38e1170f515d-dirty #32

total: 0 errors, 1 warnings, 0 checks, 8 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/src/13654829.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: HCI: fix divide error in __get_blocks()

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
6: B1 Line exceeds max length (104>80): "CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G        W          6.9.0-rc6-00001-g38e1170f515d-dirty #32"
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:

Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bpa10x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bpa10x.o'
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 492, Passed: 489 (99.4%), Failed: 1, Not Run: 2

Failed Test Cases
LL Privacy - Add Device 7 (AL is full)               Failed       0.194 seconds


---
Regards,
Linux Bluetooth

Luiz Augusto von Dentz May 6, 2024, 5:25 p.m. UTC | #2

Hi,

On Sun, May 5, 2024 at 10:21 PM Sungwoo Kim <[e-mail]> wrote:
>
> hdev->block_len could be 0. Fix this by adding a check.
>
> divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
> CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G        W          6.9.0-rc6-00001-g38e1170f515d-dirty #32
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Workqueue: hci11 hci_tx_work
> RIP: 0010:__get_blocks net/bluetooth/hci_core.c:3618 [inline]
> RIP: 0010:hci_sched_acl_blk net/bluetooth/hci_core.c:3766 [inline]
> RIP: 0010:hci_sched_acl net/bluetooth/hci_core.c:3806 [inline]
> RIP: 0010:hci_tx_work+0x73e/0x1d10 net/bluetooth/hci_core.c:3901
>
> Fixes: b71d385a18cd ("Bluetooth: Recalculate sched HCI blk/pkt flow ctrl")
> Signed-off-by: Sungwoo Kim <[e-mail]>
> ---
>  net/bluetooth/hci_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index 0efd59760..20b1cd7f3 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3762,7 +3762,7 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
>
>         __check_timeout(hdev, cnt, type);
>
> -       while (hdev->block_cnt > 0 &&
> +       while (hdev->block_len > 0 && hdev->block_cnt > 0 &&
>                (chan = hci_chan_sent(hdev, type, &quote))) {
>                 u32 priority = (skb_peek(&chan->data_q))->priority;
>                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
> --
> 2.34.1

Hmm, this code shall probably be removed as well since
HCI_FLOW_CTL_MODE_BLOCK_BASED was sort of tight to AMP support which
we have removed support for, anyway this is failing late actually
since we might have to check this during hci_conn_add with:

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 171a667bc991..73b9d08438fe 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -907,8 +907,16 @@ struct hci_conn *hci_conn_add(struct hci_dev
*hdev, int type, bdaddr_t *dst,

        switch (type) {
        case ACL_LINK:
-               if (!hdev->acl_mtu)
-                       return ERR_PTR(-ECONNREFUSED);
+               switch (hdev->flow_ctl_mode) {
+               case HCI_FLOW_CTL_MODE_PACKET_BASED:
+                       if (!hdev->acl_mtu)
+                               return ERR_PTR(-ECONNREFUSED);
+                       break;
+               case HCI_FLOW_CTL_MODE_BLOCK_BASED:
+                       if (!hdev->block_mtu)
+                               return ERR_PTR(-ECONNREFUSED);
+                       break;
+               }
                break;
        case ISO_LINK:
                if (hdev->iso_mtu)
@@ -966,7 +974,14 @@ struct hci_conn *hci_conn_add(struct hci_dev
*hdev, int type, bdaddr_t *dst,
        switch (type) {
        case ACL_LINK:
                conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
-               conn->mtu = hdev->acl_mtu;
+               switch (hdev->flow_ctl_mode) {
+               case HCI_FLOW_CTL_MODE_PACKET_BASED:
+                       conn->mtu = hdev->acl_mtu;
+                       break;
+               case HCI_FLOW_CTL_MODE_BLOCK_BASED:
+                       conn->mtu = hdev->block_mtu;
+                       break;
+               }
                break;
        case LE_LINK:
                /* conn->src should reflect the local identity address */

Patch

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 0efd59760..20b1cd7f3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3762,7 +3762,7 @@  static void hci_sched_acl_blk(struct hci_dev *hdev)
 
 	__check_timeout(hdev, cnt, type);
 
-	while (hdev->block_cnt > 0 &&
+	while (hdev->block_len > 0 && hdev->block_cnt > 0 &&
 	       (chan = hci_chan_sent(hdev, type, &quote))) {
 		u32 priority = (skb_peek(&chan->data_q))->priority;
 		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {