linux-toradex.git/include/net/bluetooth, branch v3.3.5

Bluetooth: hci_core: fix NULL-pointer dereference at unregister

2012-04-22T22:38:55+00:00

commit 94324962066231a938564bebad0f941cd2d06bb2 upstream.

Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.

This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.

Bug is 100% reproducible using hciattach and a disconnected serial port:

0. # hciattach -n /dev/ttyO1 any noflow

1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
   eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
   hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...

[   79.627136] INFO: trying to register non-static key.
[   79.632354] the code is fine but needs lockdep annotation.
[   79.638122] turning off the locking correctness validator.
[   79.643920] [] (unwind_backtrace+0x0/0xf8) from [] (__lock_acquire+0x1590/0x1ab0)
[   79.653594] [] (__lock_acquire+0x1590/0x1ab0) from [] (lock_acquire+0x9c/0x128)
[   79.663085] [] (lock_acquire+0x9c/0x128) from [] (run_timer_softirq+0x150/0x3ac)
[   79.672668] [] (run_timer_softirq+0x150/0x3ac) from [] (__do_softirq+0xd4/0x22c)
[   79.682281] [] (__do_softirq+0xd4/0x22c) from [] (irq_exit+0x8c/0x94)
[   79.690856] [] (irq_exit+0x8c/0x94) from [] (handle_IRQ+0x34/0x84)
[   79.699157] [] (handle_IRQ+0x34/0x84) from [] (omap3_intc_handle_irq+0x48/0x4c)
[   79.708648] [] (omap3_intc_handle_irq+0x48/0x4c) from [] (__irq_usr+0x3c/0x60)
[   79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.723358] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   79.756011] pgd = cf3b4000
[   79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[   79.765502] Internal error: Oops: 80000007 [#1]
[   79.770294] Modules linked in:
[   79.773529] CPU: 0    Tainted: G        W     (3.3.0-rc6-00002-gb5d5c87 #421)
[   79.781066] PC is at 0x0
[   79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[   79.788787] pc : [<00000000>]    lr : []    psr: 60000113
[   79.788787] sp : cf281ee0  ip : 00000000  fp : cf280000
[   79.800903] r10: 00000004  r9 : 00000100  r8 : b6f234d0
[   79.806427] r7 : c0519c28  r6 : cf093488  r5 : c0561a00  r4 : 00000000
[   79.813323] r3 : 00000000  r2 : c054eee0  r1 : 00000001  r0 : 00000000
[   79.820190] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   79.827728] Control: 10c5387d  Table: 8f3b4019  DAC: 00000015
[   79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[   79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[   79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[   79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[   79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[   79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[   79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[   79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[   79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[   79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[   79.922302] [] (run_timer_softirq+0x16c/0x3ac) from [] (__do_softirq+0xd4/0x22c)
[   79.931945] [] (__do_softirq+0xd4/0x22c) from [] (irq_exit+0x8c/0x94)
[   79.940582] [] (irq_exit+0x8c/0x94) from [] (handle_IRQ+0x34/0x84)
[   79.948913] [] (handle_IRQ+0x34/0x84) from [] (omap3_intc_handle_irq+0x48/0x4c)
[   79.958404] [] (omap3_intc_handle_irq+0x48/0x4c) from [] (__irq_usr+0x3c/0x60)
[   79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.973083] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.997161] Code: bad PC value
[   80.000396] ---[ end trace 6f6739840475f9ee ]---
[   80.005279] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Johan Hovold 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg 
Signed-off-by: Greg Kroah-Hartman

Bluetooth: Remove usage of __cancel_delayed_work()

2012-02-15T11:09:26+00:00

__cancel_delayed_work() is being used in some paths where we cannot
sleep waiting for the delayed work to finish. However, that function
might return while the timer is running and the work will be queued
again. Replace the calls with safer cancel_delayed_work() version
which spins until the timer handler finishes on other CPUs and
cancels the delayed work.

Signed-off-by: Ulisses Furquim 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Fix potential deadlock

2012-02-15T11:09:26+00:00

We don't need to use the _sync variant in hci_conn_hold and
hci_conn_put to cancel conn->disc_work delayed work. This way
we avoid potential deadlocks like this one reported by lockdep.

======================================================
[ INFO: possible circular locking dependency detected ]
3.2.0+ #1 Not tainted
-------------------------------------------------------
kworker/u:1/17 is trying to acquire lock:
 (&hdev->lock){+.+.+.}, at: [] hci_conn_timeout+0x62/0x158 [bluetooth]

but task is already holding lock:
 ((&(&conn->disc_work)->work)){+.+...}, at: [] process_one_work+0x11a/0x2bf

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 ((&(&conn->disc_work)->work)){+.+...}:
       [] lock_acquire+0x8a/0xa7
       [] wait_on_work+0x3d/0xaa
       [] __cancel_work_timer+0xac/0xef
       [] cancel_delayed_work_sync+0xd/0xf
       [] smp_chan_create+0xde/0xe6 [bluetooth]
       [] smp_conn_security+0xa3/0x12d [bluetooth]
       [] l2cap_connect_cfm+0x237/0x2e8 [bluetooth]
       [] hci_proto_connect_cfm+0x2d/0x6f [bluetooth]
       [] hci_event_packet+0x29d1/0x2d60 [bluetooth]
       [] hci_rx_work+0xd0/0x2e1 [bluetooth]
       [] process_one_work+0x178/0x2bf
       [] worker_thread+0xce/0x152
       [] kthread+0x95/0x9d
       [] kernel_thread_helper+0x4/0x10

-> #1 (slock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+...}:
       [] lock_acquire+0x8a/0xa7
       [] _raw_spin_lock_bh+0x36/0x6a
       [] lock_sock_nested+0x24/0x7f
       [] lock_sock+0xb/0xd [bluetooth]
       [] l2cap_chan_connect+0xa9/0x26f [bluetooth]
       [] l2cap_sock_connect+0xb3/0xff [bluetooth]
       [] sys_connect+0x69/0x8a
       [] system_call_fastpath+0x16/0x1b

-> #0 (&hdev->lock){+.+.+.}:
       [] __lock_acquire+0xa80/0xd74
       [] lock_acquire+0x8a/0xa7
       [] __mutex_lock_common+0x48/0x38e
       [] mutex_lock_nested+0x2a/0x31
       [] hci_conn_timeout+0x62/0x158 [bluetooth]
       [] process_one_work+0x178/0x2bf
       [] worker_thread+0xce/0x152
       [] kthread+0x95/0x9d
       [] kernel_thread_helper+0x4/0x10

other info that might help us debug this:

Chain exists of:
  &hdev->lock --> slock-AF_BLUETOOTH-BTPROTO_L2CAP --> (&(&conn->disc_work)->work)

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock((&(&conn->disc_work)->work));
                               lock(slock-AF_BLUETOOTH-BTPROTO_L2CAP);
                               lock((&(&conn->disc_work)->work));
  lock(&hdev->lock);

 *** DEADLOCK ***

2 locks held by kworker/u:1/17:
 #0:  (hdev->name){.+.+.+}, at: [] process_one_work+0x11a/0x2bf
 #1:  ((&(&conn->disc_work)->work)){+.+...}, at: [] process_one_work+0x11a/0x2bf

stack backtrace:
Pid: 17, comm: kworker/u:1 Not tainted 3.2.0+ #1
Call Trace:
 [] print_circular_bug+0x1f8/0x209
 [] __lock_acquire+0xa80/0xd74
 [] ? arch_local_irq_restore+0x6/0xd
 [] ? vprintk+0x3f9/0x41e
 [] lock_acquire+0x8a/0xa7
 [] ? hci_conn_timeout+0x62/0x158 [bluetooth]
 [] __mutex_lock_common+0x48/0x38e
 [] ? hci_conn_timeout+0x62/0x158 [bluetooth]
 [] ? __dynamic_pr_debug+0x6d/0x6f
 [] ? hci_conn_timeout+0x62/0x158 [bluetooth]
 [] ? trace_hardirqs_off+0xd/0xf
 [] mutex_lock_nested+0x2a/0x31
 [] hci_conn_timeout+0x62/0x158 [bluetooth]
 [] process_one_work+0x178/0x2bf
 [] ? process_one_work+0x11a/0x2bf
 [] ? lock_acquired+0x1d0/0x1df
 [] ? hci_acl_disconn+0x65/0x65 [bluetooth]
 [] worker_thread+0xce/0x152
 [] ? finish_task_switch+0x45/0xc5
 [] ? manage_workers.isra.25+0x16a/0x16a
 [] kthread+0x95/0x9d
 [] kernel_thread_helper+0x4/0x10
 [] ? retint_restore_args+0x13/0x13
 [] ? __init_kthread_worker+0x55/0x55
 [] ? gs_change+0x13/0x13

Signed-off-by: Andre Guedes 
Signed-off-by: Vinicius Costa Gomes 
Reviewed-by: Ulisses Furquim 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: silence lockdep warning

2012-02-15T11:09:26+00:00

Since bluetooth uses multiple protocols types, to avoid lockdep
warnings, we need to use different lockdep classes (one for each
protocol type).

This is already done in bt_sock_create but it misses a couple of cases
when new connections are created. This patch corrects that to fix the
following warning:

<4>[ 1864.732366] =======================================================
<4>[ 1864.733030] [ INFO: possible circular locking dependency detected ]
<4>[ 1864.733544] 3.0.16-mid3-00007-gc9a0f62 #3
<4>[ 1864.733883] -------------------------------------------------------
<4>[ 1864.734408] t.android.btclc/4204 is trying to acquire lock:
<4>[ 1864.734869]  (rfcomm_mutex){+.+.+.}, at: [] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.735541]
<4>[ 1864.735549] but task is already holding lock:
<4>[ 1864.736045]  (sk_lock-AF_BLUETOOTH){+.+.+.}, at: [] lock_sock+0xa/0xc
<4>[ 1864.736732]
<4>[ 1864.736740] which lock already depends on the new lock.
<4>[ 1864.736750]
<4>[ 1864.737428]
<4>[ 1864.737437] the existing dependency chain (in reverse order) is:
<4>[ 1864.738016]
<4>[ 1864.738023] -> #1 (sk_lock-AF_BLUETOOTH){+.+.+.}:
<4>[ 1864.738549]        [] lock_acquire+0x104/0x140
<4>[ 1864.738977]        [] lock_sock_nested+0x58/0x68
<4>[ 1864.739411]        [] l2cap_sock_sendmsg+0x3e/0x76
<4>[ 1864.739858]        [] __sock_sendmsg+0x50/0x59
<4>[ 1864.740279]        [] sock_sendmsg+0x94/0xa8
<4>[ 1864.740687]        [] kernel_sendmsg+0x28/0x37
<4>[ 1864.741106]        [] rfcomm_send_frame+0x30/0x38
<4>[ 1864.741542]        [] rfcomm_send_ua+0x58/0x5a
<4>[ 1864.741959]        [] rfcomm_run+0x441/0xb52
<4>[ 1864.742365]        [] kthread+0x63/0x68
<4>[ 1864.742742]        [] kernel_thread_helper+0x6/0xd
<4>[ 1864.743187]
<4>[ 1864.743193] -> #0 (rfcomm_mutex){+.+.+.}:
<4>[ 1864.743667]        [] __lock_acquire+0x988/0xc00
<4>[ 1864.744100]        [] lock_acquire+0x104/0x140
<4>[ 1864.744519]        [] __mutex_lock_common+0x3b/0x33f
<4>[ 1864.744975]        [] mutex_lock_nested+0x2d/0x36
<4>[ 1864.745412]        [] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.745842]        [] __rfcomm_sock_close+0x5f/0x6b
<4>[ 1864.746288]        [] rfcomm_sock_shutdown+0x2f/0x62
<4>[ 1864.746737]        [] sys_socketcall+0x1db/0x422
<4>[ 1864.747165]        [] syscall_call+0x7/0xb

Signed-off-by: Octavian Purdila 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Fix using an absolute timeout on hci_conn_put()

2012-02-15T11:09:26+00:00

queue_delayed_work() expects a relative time for when that work
should be scheduled.

Signed-off-by: Vinicius Costa Gomes 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: l2cap_set_timer needs jiffies as timeout value

2012-02-15T11:09:25+00:00

After moving L2CAP timers to workqueues l2cap_set_timer expects timeout
value to be specified in jiffies but constants defined in miliseconds
are used. This makes timeouts unreliable when CONFIG_HZ is not set to
1000.

__set_chan_timer macro still uses jiffies as input to avoid multiple
conversions from/to jiffies for sk_sndtimeo value which is already
specified in jiffies.

Signed-off-by: Andrzej Kaczmarek 
Ackec-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Remove bogus inline declaration from l2cap_chan_connect

2012-02-15T11:09:25+00:00

As reported by Dan Carpenter this function causes a Sparse warning and
shouldn't be declared inline:

include/net/bluetooth/l2cap.h:837:30 error: marked inline, but without a
definition"

Reported-by: Dan Carpenter 
Signed-off-by: Johan Hedberg 
Acked-by: Marcel Holtmann

bluetooth: hci: Fix type of "enable_hs" to bool.

2012-01-22T20:08:46+00:00

Fixes:

net/bluetooth/hci_core.c: In function ‘__check_enable_hs’:
net/bluetooth/hci_core.c:2587:1: warning: return from incompatible pointer type [enabled by default]

Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/padovan/bluetooth-next

2012-01-10T20:44:17+00:00

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

2012-01-03T20:16:34+00:00

Conflicts:
	drivers/net/wireless/b43/dma.c
	drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c