Commit 4b8af331 authored by Abhishek Pandit-Subedi's avatar Abhishek Pandit-Subedi Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: Prevent double register of suspend 



Suspend notifier should only be registered and unregistered once per
hdev. Simplify this by only registering during driver registration and
simply exiting early when HCI_USER_CHANNEL is set.

Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Fixes: 359ee4f8 (Bluetooth: Unregister suspend with userchannel)
Signed-off-by: default avatarAbhishek Pandit-Subedi <abhishekpandit@chromium.org>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 116523c8

net/bluetooth/hci_core.c

+4 −0
Original line number Diff line number Diff line
@@ -2406,6 +2406,10 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, 
		container_of(nb, struct hci_dev, suspend_notifier);

	int ret = 0;



	/* Userspace has full control of this device. Do nothing. */

	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))

		return NOTIFY_DONE;



	if (action == PM_SUSPEND_PREPARE)

		ret = hci_suspend_dev(hdev);

	else if (action == PM_POST_SUSPEND)

net/bluetooth/hci_sock.c

+0 −3
Original line number Diff line number Diff line
@@ -887,7 +887,6 @@ static int hci_sock_release(struct socket *sock) 
			 */

			hci_dev_do_close(hdev);

			hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);

			hci_register_suspend_notifier(hdev);

			mgmt_index_added(hdev);

		}
@@ -1216,7 +1215,6 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, 
		}



		mgmt_index_removed(hdev);

		hci_unregister_suspend_notifier(hdev);



		err = hci_dev_open(hdev->id);

		if (err) {
@@ -1231,7 +1229,6 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, 
				err = 0;

			} else {

				hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);

				hci_register_suspend_notifier(hdev);

				mgmt_index_added(hdev);

				hci_dev_put(hdev);

				goto done;