RE: [PATCH] Bluetooth: btnxpuart: Shutdown timer and prevent rearming when driver unloading

[Bough Chen]

> -----Original Message-----
> From: Luke Wang <ziniu.wang_1@xxxxxxx>
> Sent: 2024年5月17日 19:16
> To: marcel@xxxxxxxxxxxx; luiz.dentz@xxxxxxxxx
> Cc: linux-bluetooth@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Amitkumar
> Karwar <amitkumar.karwar@xxxxxxx>; Rohit Fule <rohit.fule@xxxxxxx>;
> Neeraj Sanjay Kale <neeraj.sanjaykale@xxxxxxx>; Sherry Sun
> <sherry.sun@xxxxxxx>; Bough Chen <haibo.chen@xxxxxxx>; Jun Li
> <jun.li@xxxxxxx>; Guillaume Legoupil <guillaume.legoupil@xxxxxxx>; Salim
> Chebbo <salim.chebbo@xxxxxxx>; imx@xxxxxxxxxxxxxxx
> Subject: [PATCH] Bluetooth: btnxpuart: Shutdown timer and prevent rearming
> when driver unloading
> 
> From: Luke Wang <ziniu.wang_1@xxxxxxx>
> 
> When unload the btnxpuart driver, its associated timer will be deleted.
> If the timer happens to be modified at this moment, it leads to the kernel call
> this timer even after the driver unloaded, resulting in kernel panic.
> Use timer_shutdown_sync() instead of del_timer_sync() to prevent rearming.
> 
> panic log:
>   Internal error: Oops: 0000000086000007 [#1] PREEMPT SMP
>   Modules linked in: algif_hash algif_skcipher af_alg moal(O) mlan(O)
> crct10dif_ce polyval_ce polyval_generic   snd_soc_imx_card
> snd_soc_fsl_asoc_card snd_soc_imx_audmux mxc_jpeg_encdec v4l2_jpeg
> snd_soc_wm8962 snd_soc_fsl_micfil   snd_soc_fsl_sai flexcan snd_soc_fsl_utils
> ap130x rpmsg_ctrl imx_pcm_dma can_dev rpmsg_char pwm_fan fuse [last
> unloaded:   btnxpuart]
>   CPU: 5 PID: 723 Comm: memtester Tainted: G           O
> 6.6.23-lts-next-06207-g4aef2658ac28 #1
>   Hardware name: NXP i.MX95 19X19 board (DT)
>   pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>   pc : 0xffff80007a2cf464
>   lr : call_timer_fn.isra.0+0x24/0x80
> ...
>   Call trace:
>    0xffff80007a2cf464
>    __run_timers+0x234/0x280
>    run_timer_softirq+0x20/0x40
>    __do_softirq+0x100/0x26c
>    ____do_softirq+0x10/0x1c
>    call_on_irq_stack+0x24/0x4c
>    do_softirq_own_stack+0x1c/0x2c
>    irq_exit_rcu+0xc0/0xdc
>    el0_interrupt+0x54/0xd8
>    __el0_irq_handler_common+0x18/0x24
>    el0t_64_irq_handler+0x10/0x1c
>    el0t_64_irq+0x190/0x194
>   Code: ???????? ???????? ???????? ???????? (????????)
>   ---[ end trace 0000000000000000 ]---
>   Kernel panic - not syncing: Oops: Fatal exception in interrupt
>   SMP: stopping secondary CPUs
>   Kernel Offset: disabled
>   CPU features: 0x0,c0000000,40028143,1000721b
>   Memory Limit: none
>   ---[ end Kernel panic - not syncing: Oops: Fatal exception in interrupt ]---


Hi all,

This patch is already accepted, but I notice it lack fix tag, can anyone help add the following fix tag?
Fixes: 689ca16e5232 ("Bluetooth: NXP: Add protocol support for NXP Bluetooth chipsets")
Cc: stable@xxxxxxxxxxxxxxx

This patch should also put into stable tree. I add the stable tree mail list here. 

Best Regards
Haibo Chen
> 
> Signed-off-by: Luke Wang <ziniu.wang_1@xxxxxxx>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c index
> 7f88b6f52f26..77f974a5251b 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -328,7 +328,7 @@ static void ps_cancel_timer(struct btnxpuart_dev
> *nxpdev)
>  	struct ps_data *psdata = &nxpdev->psdata;
> 
>  	flush_work(&psdata->work);
> -	del_timer_sync(&psdata->ps_timer);
> +	timer_shutdown_sync(&psdata->ps_timer);
>  }
> 
>  static void ps_control(struct hci_dev *hdev, u8 ps_state)
> --
> 2.34.1