diff mbox series

[v1] Bluetooth: MGMT: Fix possible deadlocks

Message ID 20241121164335.3848135-1-luiz.dentz@gmail.com (mailing list archive)
State Accepted
Commit 4ae007fdffc9715ae0729ca0d2cb446b83f8b64d
Headers show
Series [v1] Bluetooth: MGMT: Fix possible deadlocks | expand

Checks

Context Check Description
tedd_an/pre-ci_am success Success
tedd_an/SubjectPrefix success Gitlint PASS
tedd_an/BuildKernel success BuildKernel PASS
tedd_an/CheckAllWarning success CheckAllWarning PASS
tedd_an/CheckSparse success CheckSparse PASS
tedd_an/BuildKernel32 success BuildKernel32 PASS
tedd_an/TestRunnerSetup success TestRunnerSetup PASS
tedd_an/TestRunner_l2cap-tester success TestRunner PASS
tedd_an/TestRunner_iso-tester fail TestRunner_iso-tester: WARNING: possible circular locking dependency detected
tedd_an/TestRunner_bnep-tester success TestRunner PASS
tedd_an/TestRunner_mgmt-tester fail TestRunner_mgmt-tester: Total: 492, Passed: 487 (99.0%), Failed: 1, Not Run: 4
tedd_an/TestRunner_rfcomm-tester success TestRunner PASS
tedd_an/TestRunner_sco-tester success TestRunner PASS
tedd_an/TestRunner_ioctl-tester success TestRunner PASS
tedd_an/TestRunner_mesh-tester success TestRunner PASS
tedd_an/TestRunner_smp-tester success TestRunner PASS
tedd_an/TestRunner_userchan-tester success TestRunner PASS

Commit Message

Luiz Augusto von Dentz Nov. 21, 2024, 4:43 p.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes possible deadlocks like the following caused by
hci_cmd_sync_dequeue causing the destroy function to run:

 INFO: task kworker/u19:0:143 blocked for more than 120 seconds.
       Tainted: G        W  O        6.8.0-2024-03-19-intel-next-iLS-24ww14 #1
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 task:kworker/u19:0   state:D stack:0     pid:143   tgid:143   ppid:2      flags:0x00004000
 Workqueue: hci0 hci_cmd_sync_work [bluetooth]
 Call Trace:
  <TASK>
  __schedule+0x374/0xaf0
  schedule+0x3c/0xf0
  schedule_preempt_disabled+0x1c/0x30
  __mutex_lock.constprop.0+0x3ef/0x7a0
  __mutex_lock_slowpath+0x13/0x20
  mutex_lock+0x3c/0x50
  mgmt_set_connectable_complete+0xa4/0x150 [bluetooth]
  ? kfree+0x211/0x2a0
  hci_cmd_sync_dequeue+0xae/0x130 [bluetooth]
  ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth]
  cmd_complete_rsp+0x26/0x80 [bluetooth]
  mgmt_pending_foreach+0x4d/0x70 [bluetooth]
  __mgmt_power_off+0x8d/0x180 [bluetooth]
  ? _raw_spin_unlock_irq+0x23/0x40
  hci_dev_close_sync+0x445/0x5b0 [bluetooth]
  hci_set_powered_sync+0x149/0x250 [bluetooth]
  set_powered_sync+0x24/0x60 [bluetooth]
  hci_cmd_sync_work+0x90/0x150 [bluetooth]
  process_one_work+0x13e/0x300
  worker_thread+0x2f7/0x420
  ? __pfx_worker_thread+0x10/0x10
  kthread+0x107/0x140
  ? __pfx_kthread+0x10/0x10
  ret_from_fork+0x3d/0x60
  ? __pfx_kthread+0x10/0x10
  ret_from_fork_asm+0x1b/0x30
  </TASK>

Fixes: f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on mgmt_index_removed")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/mgmt.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

Comments

bluez.test.bot@gmail.com Nov. 21, 2024, 5:31 p.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=911554

---Test result---

Test Summary:
CheckPatch                    PENDING   0.24 seconds
GitLint                       PENDING   0.21 seconds
SubjectPrefix                 PASS      0.12 seconds
BuildKernel                   PASS      24.95 seconds
CheckAllWarning               PASS      27.42 seconds
CheckSparse                   PASS      30.87 seconds
BuildKernel32                 PASS      25.79 seconds
TestRunnerSetup               PASS      444.05 seconds
TestRunner_l2cap-tester       PASS      22.55 seconds
TestRunner_iso-tester         FAIL      30.68 seconds
TestRunner_bnep-tester        PASS      5.06 seconds
TestRunner_mgmt-tester        FAIL      121.90 seconds
TestRunner_rfcomm-tester      PASS      7.63 seconds
TestRunner_sco-tester         PASS      13.49 seconds
TestRunner_ioctl-tester       PASS      8.14 seconds
TestRunner_mesh-tester        PASS      6.62 seconds
TestRunner_smp-tester         PASS      6.98 seconds
TestRunner_userchan-tester    PASS      5.03 seconds
IncrementalBuild              PENDING   0.96 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
Total: 124, Passed: 120 (96.8%), Failed: 0, Not Run: 4
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 492, Passed: 487 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
LL Privacy - Start Discovery 2 (Disable RL)          Failed       0.177 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth
K, Kiran Nov. 22, 2024, 9:28 a.m. UTC | #2 
Hi Luiz,

>-----Original Message-----
>From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
>Sent: Thursday, November 21, 2024 10:14 PM
>To: linux-bluetooth@vger.kernel.org
>Subject: [PATCH v1] Bluetooth: MGMT: Fix possible deadlocks
>
>From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
>
>This fixes possible deadlocks like the following caused by
>hci_cmd_sync_dequeue causing the destroy function to run:
>
> INFO: task kworker/u19:0:143 blocked for more than 120 seconds.
>       Tainted: G        W  O        6.8.0-2024-03-19-intel-next-iLS-24ww14 #1
> "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
> task:kworker/u19:0   state:D stack:0     pid:143   tgid:143   ppid:2
>flags:0x00004000
> Workqueue: hci0 hci_cmd_sync_work [bluetooth]  Call Trace:
>  <TASK>
>  __schedule+0x374/0xaf0
>  schedule+0x3c/0xf0
>  schedule_preempt_disabled+0x1c/0x30
>  __mutex_lock.constprop.0+0x3ef/0x7a0
>  __mutex_lock_slowpath+0x13/0x20
>  mutex_lock+0x3c/0x50
>  mgmt_set_connectable_complete+0xa4/0x150 [bluetooth]
>  ? kfree+0x211/0x2a0
>  hci_cmd_sync_dequeue+0xae/0x130 [bluetooth]
>  ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth]
>  cmd_complete_rsp+0x26/0x80 [bluetooth]
>  mgmt_pending_foreach+0x4d/0x70 [bluetooth]
>  __mgmt_power_off+0x8d/0x180 [bluetooth]
>  ? _raw_spin_unlock_irq+0x23/0x40
>  hci_dev_close_sync+0x445/0x5b0 [bluetooth]
>  hci_set_powered_sync+0x149/0x250 [bluetooth]
>  set_powered_sync+0x24/0x60 [bluetooth]
>  hci_cmd_sync_work+0x90/0x150 [bluetooth]
>  process_one_work+0x13e/0x300
>  worker_thread+0x2f7/0x420
>  ? __pfx_worker_thread+0x10/0x10
>  kthread+0x107/0x140
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork+0x3d/0x60
>  ? __pfx_kthread+0x10/0x10
>  ret_from_fork_asm+0x1b/0x30
>  </TASK>
>
>Fixes: f53e1c9c726d ("Bluetooth: MGMT: Fix possible crash on
>mgmt_index_removed")
>Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Tested-by: Kiran K <kiran.k@intel.com>

>---
> net/bluetooth/mgmt.c | 27 ++++++++++++++++++---------
> 1 file changed, 18 insertions(+), 9 deletions(-)
>
>diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index
>e406eb8e4327..b31192d473d0 100644
>--- a/net/bluetooth/mgmt.c
>+++ b/net/bluetooth/mgmt.c
>@@ -1518,7 +1518,8 @@ static void mgmt_set_discoverable_complete(struct
>hci_dev *hdev, void *data,
> 	bt_dev_dbg(hdev, "err %d", err);
>
> 	/* Make sure cmd still outstanding. */
>-	if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
>+	if (err == -ECANCELED ||
>+	    cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
> 		return;
>
> 	hci_dev_lock(hdev);
>@@ -1692,7 +1693,8 @@ static void mgmt_set_connectable_complete(struct
>hci_dev *hdev, void *data,
> 	bt_dev_dbg(hdev, "err %d", err);
>
> 	/* Make sure cmd still outstanding. */
>-	if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
>+	if (err == -ECANCELED ||
>+	    cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
> 		return;
>
> 	hci_dev_lock(hdev);
>@@ -1924,7 +1926,7 @@ static void set_ssp_complete(struct hci_dev *hdev,
>void *data, int err)
> 	bool changed;
>
> 	/* Make sure cmd still outstanding. */
>-	if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
>+	if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP,
>hdev))
> 		return;
>
> 	if (err) {
>@@ -3848,7 +3850,8 @@ static void set_name_complete(struct hci_dev
>*hdev, void *data, int err)
>
> 	bt_dev_dbg(hdev, "err %d", err);
>
>-	if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
>+	if (err == -ECANCELED ||
>+	    cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
> 		return;
>
> 	if (status) {
>@@ -4023,7 +4026,8 @@ static void set_default_phy_complete(struct hci_dev
>*hdev, void *data, int err)
> 	struct sk_buff *skb = cmd->skb;
> 	u8 status = mgmt_status(err);
>
>-	if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
>+	if (err == -ECANCELED ||
>+	    cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
> 		return;
>
> 	if (!status) {
>@@ -5914,13 +5918,16 @@ static void start_discovery_complete(struct
>hci_dev *hdev, void *data, int err)  {
> 	struct mgmt_pending_cmd *cmd = data;
>
>+	bt_dev_dbg(hdev, "err %d", err);
>+
>+	if (err == -ECANCELED)
>+		return;
>+
> 	if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
> 	    cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev)
>&&
> 	    cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY,
>hdev))
> 		return;
>
>-	bt_dev_dbg(hdev, "err %d", err);
>-
> 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode,
>mgmt_status(err),
> 			  cmd->param, 1);
> 	mgmt_pending_remove(cmd);
>@@ -6153,7 +6160,8 @@ static void stop_discovery_complete(struct hci_dev
>*hdev, void *data, int err)  {
> 	struct mgmt_pending_cmd *cmd = data;
>
>-	if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
>+	if (err == -ECANCELED ||
>+	    cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
> 		return;
>
> 	bt_dev_dbg(hdev, "err %d", err);
>@@ -8144,7 +8152,8 @@ static void
>read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
> 	u8 status = mgmt_status(err);
> 	u16 eir_len;
>
>-	if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
>hdev))
>+	if (err == -ECANCELED ||
>+	    cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA,
>hdev))
> 		return;
>
> 	if (!status) {
>--
>2.47.0
>

Thanks,
Kiran
patchwork-bot+bluetooth@kernel.org Nov. 22, 2024, 6:30 p.m. UTC | #3 
Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 21 Nov 2024 11:43:35 -0500 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> This fixes possible deadlocks like the following caused by
> hci_cmd_sync_dequeue causing the destroy function to run:
> 
>  INFO: task kworker/u19:0:143 blocked for more than 120 seconds.
>        Tainted: G        W  O        6.8.0-2024-03-19-intel-next-iLS-24ww14 #1
>  "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
>  task:kworker/u19:0   state:D stack:0     pid:143   tgid:143   ppid:2      flags:0x00004000
>  Workqueue: hci0 hci_cmd_sync_work [bluetooth]
>  Call Trace:
>   <TASK>
>   __schedule+0x374/0xaf0
>   schedule+0x3c/0xf0
>   schedule_preempt_disabled+0x1c/0x30
>   __mutex_lock.constprop.0+0x3ef/0x7a0
>   __mutex_lock_slowpath+0x13/0x20
>   mutex_lock+0x3c/0x50
>   mgmt_set_connectable_complete+0xa4/0x150 [bluetooth]
>   ? kfree+0x211/0x2a0
>   hci_cmd_sync_dequeue+0xae/0x130 [bluetooth]
>   ? __pfx_cmd_complete_rsp+0x10/0x10 [bluetooth]
>   cmd_complete_rsp+0x26/0x80 [bluetooth]
>   mgmt_pending_foreach+0x4d/0x70 [bluetooth]
>   __mgmt_power_off+0x8d/0x180 [bluetooth]
>   ? _raw_spin_unlock_irq+0x23/0x40
>   hci_dev_close_sync+0x445/0x5b0 [bluetooth]
>   hci_set_powered_sync+0x149/0x250 [bluetooth]
>   set_powered_sync+0x24/0x60 [bluetooth]
>   hci_cmd_sync_work+0x90/0x150 [bluetooth]
>   process_one_work+0x13e/0x300
>   worker_thread+0x2f7/0x420
>   ? __pfx_worker_thread+0x10/0x10
>   kthread+0x107/0x140
>   ? __pfx_kthread+0x10/0x10
>   ret_from_fork+0x3d/0x60
>   ? __pfx_kthread+0x10/0x10
>   ret_from_fork_asm+0x1b/0x30
>   </TASK>
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: MGMT: Fix possible deadlocks
    https://git.kernel.org/bluetooth/bluetooth-next/c/4ae007fdffc9

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index e406eb8e4327..b31192d473d0 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1518,7 +1518,8 @@  static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
 	bt_dev_dbg(hdev, "err %d", err);
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
 		return;
 
 	hci_dev_lock(hdev);
@@ -1692,7 +1693,8 @@  static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
 	bt_dev_dbg(hdev, "err %d", err);
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
 		return;
 
 	hci_dev_lock(hdev);
@@ -1924,7 +1926,7 @@  static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
 	bool changed;
 
 	/* Make sure cmd still outstanding. */
-	if (cmd != pending_find(MGMT_OP_SET_SSP, hdev))
+	if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev))
 		return;
 
 	if (err) {
@@ -3848,7 +3850,8 @@  static void set_name_complete(struct hci_dev *hdev, void *data, int err)
 
 	bt_dev_dbg(hdev, "err %d", err);
 
-	if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
 		return;
 
 	if (status) {
@@ -4023,7 +4026,8 @@  static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
 	struct sk_buff *skb = cmd->skb;
 	u8 status = mgmt_status(err);
 
-	if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
 		return;
 
 	if (!status) {
@@ -5914,13 +5918,16 @@  static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
 {
 	struct mgmt_pending_cmd *cmd = data;
 
+	bt_dev_dbg(hdev, "err %d", err);
+
+	if (err == -ECANCELED)
+		return;
+
 	if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
 	    cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
 	    cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
 		return;
 
-	bt_dev_dbg(hdev, "err %d", err);
-
 	mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err),
 			  cmd->param, 1);
 	mgmt_pending_remove(cmd);
@@ -6153,7 +6160,8 @@  static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
 {
 	struct mgmt_pending_cmd *cmd = data;
 
-	if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
 		return;
 
 	bt_dev_dbg(hdev, "err %d", err);
@@ -8144,7 +8152,8 @@  static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
 	u8 status = mgmt_status(err);
 	u16 eir_len;
 
-	if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
+	if (err == -ECANCELED ||
+	    cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
 		return;
 
 	if (!status) {