NetBSD-Bugs archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
kern/56988: Bluetooth stack initializes bt_lock too late
>Number: 56988
>Category: kern
>Synopsis: Bluetooth stack initializes bt_lock too late
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Tue Aug 30 11:00:00 +0000 2022
>Originator: Taylor R Campbell
>Release: current
>Organization:
The WetBSD Fountation
>Environment:
>Description:
The Bluetooth stack initializes bt_lock as part of the Bluetooth socket domain initialization routine.
However, the Bluetooth stack also uses bt_lock when attaching Bluetooth HCI devices, which can be detected by autoconf before domaininint. This leads to a null pointer dereference.
>How-To-Repeat:
Boot a machine with ubt(4) and enough of a delay in lwp0 during autoconf that ubt(4) attaches before domaininit in init_main.c.
>Fix:
The following patch creates a driver-class module `netbt' whose initialization routine initializes bt_lock. This happens before configure().
Maybe kinda grody for netbt to be a driver-class module; maybe this should live somewhere in sys/dev/bluetooth.
From 23dfe7b917889c5421f39e4651e1018c8f073d89 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
Date: Mon, 29 Aug 2022 17:46:49 +0000
Subject: [PATCH] WIP: netbt(4): Initialize bt_lock earlier.
Use a driver-class module modcmd init function, instead of a socket
domain init function; the socket-domain ones don't run until after
configure, but we need this to be initialized before configure so
that Bluetooth HCI drivers like ubt(4) can use it.
---
sys/netbt/bt_proto.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/sys/netbt/bt_proto.c b/sys/netbt/bt_proto.c
index 15e2c99d7411..d2ab7ee45161 100644
--- a/sys/netbt/bt_proto.c
+++ b/sys/netbt/bt_proto.c
@@ -36,6 +36,7 @@ __KERNEL_RCSID(0, "$NetBSD: bt_proto.c,v 1.16 2016/01/21 15:41:30 riastradh Exp
#include <sys/param.h>
#include <sys/domain.h>
#include <sys/kernel.h>
+#include <sys/module.h>
#include <sys/protosw.h>
#include <sys/socket.h>
#include <sys/systm.h>
@@ -112,7 +113,22 @@ kmutex_t *bt_lock;
static void
bt_init(void)
+{
+}
+
+MODULE(MODULE_CLASS_DRIVER, netbt, NULL);
+
+static int
+netbt_modcmd(modcmd_t cmd, void *aux)
{
- bt_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
+ switch (cmd) {
+ case MODULE_CMD_INIT:
+ bt_lock = mutex_obj_alloc(MUTEX_DEFAULT, IPL_NONE);
+ return 0;
+ case MODULE_CMD_FINI:
+ return EBUSY; /* XXX */
+ default:
+ return ENOTTY;
+ }
}
Home |
Main Index |
Thread Index |
Old Index