linux-toradex.git/include/net, branch v3.3.5

Bluetooth: hci_core: fix NULL-pointer dereference at unregister

2012-04-22T22:38:55+00:00

commit 94324962066231a938564bebad0f941cd2d06bb2 upstream.

Make sure hci_dev_open returns immediately if hci_dev_unregister has
been called.

This fixes a race between hci_dev_open and hci_dev_unregister which can
lead to a NULL-pointer dereference.

Bug is 100% reproducible using hciattach and a disconnected serial port:

0. # hciattach -n /dev/ttyO1 any noflow

1. hci_dev_open called from hci_power_on grabs req lock
2. hci_init_req executes but device fails to initialise (times out
   eventually)
3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock
4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in
   hci_dev_do_close
5. hci_dev_open (1) releases req lock
6. hci_dev_do_close grabs req lock and returns as device is not up
7. hci_dev_unregister sleeps in destroy_workqueue
8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps
9. hci_dev_unregister finishes, while hci_dev_open is still running...

[   79.627136] INFO: trying to register non-static key.
[   79.632354] the code is fine but needs lockdep annotation.
[   79.638122] turning off the locking correctness validator.
[   79.643920] [] (unwind_backtrace+0x0/0xf8) from [] (__lock_acquire+0x1590/0x1ab0)
[   79.653594] [] (__lock_acquire+0x1590/0x1ab0) from [] (lock_acquire+0x9c/0x128)
[   79.663085] [] (lock_acquire+0x9c/0x128) from [] (run_timer_softirq+0x150/0x3ac)
[   79.672668] [] (run_timer_softirq+0x150/0x3ac) from [] (__do_softirq+0xd4/0x22c)
[   79.682281] [] (__do_softirq+0xd4/0x22c) from [] (irq_exit+0x8c/0x94)
[   79.690856] [] (irq_exit+0x8c/0x94) from [] (handle_IRQ+0x34/0x84)
[   79.699157] [] (handle_IRQ+0x34/0x84) from [] (omap3_intc_handle_irq+0x48/0x4c)
[   79.708648] [] (omap3_intc_handle_irq+0x48/0x4c) from [] (__irq_usr+0x3c/0x60)
[   79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.723358] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000
[   79.756011] pgd = cf3b4000
[   79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000
[   79.765502] Internal error: Oops: 80000007 [#1]
[   79.770294] Modules linked in:
[   79.773529] CPU: 0    Tainted: G        W     (3.3.0-rc6-00002-gb5d5c87 #421)
[   79.781066] PC is at 0x0
[   79.783721] LR is at run_timer_softirq+0x16c/0x3ac
[   79.788787] pc : [<00000000>]    lr : []    psr: 60000113
[   79.788787] sp : cf281ee0  ip : 00000000  fp : cf280000
[   79.800903] r10: 00000004  r9 : 00000100  r8 : b6f234d0
[   79.806427] r7 : c0519c28  r6 : cf093488  r5 : c0561a00  r4 : 00000000
[   79.813323] r3 : 00000000  r2 : c054eee0  r1 : 00000001  r0 : 00000000
[   79.820190] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   79.827728] Control: 10c5387d  Table: 8f3b4019  DAC: 00000015
[   79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8)
[   79.839965] Stack: (0xcf281ee0 to 0xcf282000)
[   79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000
[   79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18
[   79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004
[   79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a
[   79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004
[   79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530
[   79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698
[   79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00
[   79.922302] [] (run_timer_softirq+0x16c/0x3ac) from [] (__do_softirq+0xd4/0x22c)
[   79.931945] [] (__do_softirq+0xd4/0x22c) from [] (irq_exit+0x8c/0x94)
[   79.940582] [] (irq_exit+0x8c/0x94) from [] (handle_IRQ+0x34/0x84)
[   79.948913] [] (handle_IRQ+0x34/0x84) from [] (omap3_intc_handle_irq+0x48/0x4c)
[   79.958404] [] (omap3_intc_handle_irq+0x48/0x4c) from [] (__irq_usr+0x3c/0x60)
[   79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8)
[   79.973083] 1fa0:                                     0001e6a0 be8dab00 0001e698 00036698
[   79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000
[   79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff
[   79.997161] Code: bad PC value
[   80.000396] ---[ end trace 6f6739840475f9ee ]---
[   80.005279] Kernel panic - not syncing: Fatal exception in interrupt

Signed-off-by: Johan Hovold 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg 
Signed-off-by: Greg Kroah-Hartman

route: Remove redirect_genid

2012-03-08T08:30:32+00:00

As we invalidate the inetpeer tree along with the routing cache now,
we don't need a genid to reset the redirect handling when the routing
cache is flushed.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

inetpeer: Invalidate the inetpeer tree along with the routing cache

2012-03-08T08:30:24+00:00

We initialize the routing metrics with the values cached on the
inetpeer in rt_init_metrics(). So if we have the metrics cached on the
inetpeer, we ignore the user configured fib_metrics.

To fix this issue, we replace the old tree with a fresh initialized
inet_peer_base. The old tree is removed later with a delayed work queue.

Signed-off-by: Steffen Klassert 
Signed-off-by: David S. Miller

tcp: fix comment for tp->highest_sack

2012-02-28T20:06:33+00:00

There was an off-by-one error in the comments describing the
highest_sack field in struct tcp_sock. The comments previously claimed
that it was the "start sequence of the highest skb with SACKed
bit". This commit fixes the comments to note that it is the "start
sequence of the skb just *after* the highest skb with SACKed bit".

Signed-off-by: Neal Cardwell 
Acked-by: Ilpo Järvinen 
Signed-off-by: David S. Miller

netfilter: ctnetlink: fix soft lockup when netlink adds new entries (v2)

2012-02-24T11:24:15+00:00

Marcell Zambo and Janos Farago noticed and reported that when
new conntrack entries are added via netlink and the conntrack table
gets full, soft lockup happens. This is because the nf_conntrack_lock
is held while nf_conntrack_alloc is called, which is in turn wants
to lock nf_conntrack_lock while evicting entries from the full table.

The patch fixes the soft lockup with limiting the holding of the
nf_conntrack_lock to the minimum, where it's absolutely required.
It required to extend (and thus change) nf_conntrack_hash_insert
so that it makes sure conntrack and ctnetlink do not add the same entry
twice to the conntrack table.

Signed-off-by: Jozsef Kadlecsik 
Signed-off-by: Pablo Neira Ayuso

rtnetlink: Fix problem with buffer allocation

2012-02-21T21:56:45+00:00

Implement a new netlink attribute type IFLA_EXT_MASK.  The mask
is a 32 bit value that can be used to indicate to the kernel that
certain extended ifinfo values are requested by the user application.
At this time the only mask value defined is RTEXT_FILTER_VF to
indicate that the user wants the ifinfo dump to send information
about the VFs belonging to the interface.

This patch fixes a bug in which certain applications do not have
large enough buffers to accommodate the extra information returned
by the kernel with large numbers of SR-IOV virtual functions.
Those applications will not send the new netlink attribute with
the interface info dump request netlink messages so they will
not get unexpectedly large request buffers returned by the kernel.

Modifies the rtnl_calcit function to traverse the list of net
devices and compute the minimum buffer size that can hold the
info dumps of all matching devices based upon the filter passed
in via the new netlink attribute filter mask.  If no filter
mask is sent then the buffer allocation defaults to NLMSG_GOODSIZE.

With this change it is possible to add yet to be defined netlink
attributes to the dump request which should make it fairly extensible
in the future.

Signed-off-by: Greg Rose 
Signed-off-by: David S. Miller

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

2012-02-20T19:47:17+00:00

Bluetooth: Remove usage of __cancel_delayed_work()

2012-02-15T11:09:26+00:00

__cancel_delayed_work() is being used in some paths where we cannot
sleep waiting for the delayed work to finish. However, that function
might return while the timer is running and the work will be queued
again. Replace the calls with safer cancel_delayed_work() version
which spins until the timer handler finishes on other CPUs and
cancels the delayed work.

Signed-off-by: Ulisses Furquim 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: Fix potential deadlock

2012-02-15T11:09:26+00:00

We don't need to use the _sync variant in hci_conn_hold and
hci_conn_put to cancel conn->disc_work delayed work. This way
we avoid potential deadlocks like this one reported by lockdep.

======================================================
[ INFO: possible circular locking dependency detected ]
3.2.0+ #1 Not tainted
-------------------------------------------------------
kworker/u:1/17 is trying to acquire lock:
 (&hdev->lock){+.+.+.}, at: [] hci_conn_timeout+0x62/0x158 [bluetooth]

but task is already holding lock:
 ((&(&conn->disc_work)->work)){+.+...}, at: [] process_one_work+0x11a/0x2bf

which lock already depends on the new lock.

the existing dependency chain (in reverse order) is:

-> #2 ((&(&conn->disc_work)->work)){+.+...}:
       [] lock_acquire+0x8a/0xa7
       [] wait_on_work+0x3d/0xaa
       [] __cancel_work_timer+0xac/0xef
       [] cancel_delayed_work_sync+0xd/0xf
       [] smp_chan_create+0xde/0xe6 [bluetooth]
       [] smp_conn_security+0xa3/0x12d [bluetooth]
       [] l2cap_connect_cfm+0x237/0x2e8 [bluetooth]
       [] hci_proto_connect_cfm+0x2d/0x6f [bluetooth]
       [] hci_event_packet+0x29d1/0x2d60 [bluetooth]
       [] hci_rx_work+0xd0/0x2e1 [bluetooth]
       [] process_one_work+0x178/0x2bf
       [] worker_thread+0xce/0x152
       [] kthread+0x95/0x9d
       [] kernel_thread_helper+0x4/0x10

-> #1 (slock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+...}:
       [] lock_acquire+0x8a/0xa7
       [] _raw_spin_lock_bh+0x36/0x6a
       [] lock_sock_nested+0x24/0x7f
       [] lock_sock+0xb/0xd [bluetooth]
       [] l2cap_chan_connect+0xa9/0x26f [bluetooth]
       [] l2cap_sock_connect+0xb3/0xff [bluetooth]
       [] sys_connect+0x69/0x8a
       [] system_call_fastpath+0x16/0x1b

-> #0 (&hdev->lock){+.+.+.}:
       [] __lock_acquire+0xa80/0xd74
       [] lock_acquire+0x8a/0xa7
       [] __mutex_lock_common+0x48/0x38e
       [] mutex_lock_nested+0x2a/0x31
       [] hci_conn_timeout+0x62/0x158 [bluetooth]
       [] process_one_work+0x178/0x2bf
       [] worker_thread+0xce/0x152
       [] kthread+0x95/0x9d
       [] kernel_thread_helper+0x4/0x10

other info that might help us debug this:

Chain exists of:
  &hdev->lock --> slock-AF_BLUETOOTH-BTPROTO_L2CAP --> (&(&conn->disc_work)->work)

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock((&(&conn->disc_work)->work));
                               lock(slock-AF_BLUETOOTH-BTPROTO_L2CAP);
                               lock((&(&conn->disc_work)->work));
  lock(&hdev->lock);

 *** DEADLOCK ***

2 locks held by kworker/u:1/17:
 #0:  (hdev->name){.+.+.+}, at: [] process_one_work+0x11a/0x2bf
 #1:  ((&(&conn->disc_work)->work)){+.+...}, at: [] process_one_work+0x11a/0x2bf

stack backtrace:
Pid: 17, comm: kworker/u:1 Not tainted 3.2.0+ #1
Call Trace:
 [] print_circular_bug+0x1f8/0x209
 [] __lock_acquire+0xa80/0xd74
 [] ? arch_local_irq_restore+0x6/0xd
 [] ? vprintk+0x3f9/0x41e
 [] lock_acquire+0x8a/0xa7
 [] ? hci_conn_timeout+0x62/0x158 [bluetooth]
 [] __mutex_lock_common+0x48/0x38e
 [] ? hci_conn_timeout+0x62/0x158 [bluetooth]
 [] ? __dynamic_pr_debug+0x6d/0x6f
 [] ? hci_conn_timeout+0x62/0x158 [bluetooth]
 [] ? trace_hardirqs_off+0xd/0xf
 [] mutex_lock_nested+0x2a/0x31
 [] hci_conn_timeout+0x62/0x158 [bluetooth]
 [] process_one_work+0x178/0x2bf
 [] ? process_one_work+0x11a/0x2bf
 [] ? lock_acquired+0x1d0/0x1df
 [] ? hci_acl_disconn+0x65/0x65 [bluetooth]
 [] worker_thread+0xce/0x152
 [] ? finish_task_switch+0x45/0xc5
 [] ? manage_workers.isra.25+0x16a/0x16a
 [] kthread+0x95/0x9d
 [] kernel_thread_helper+0x4/0x10
 [] ? retint_restore_args+0x13/0x13
 [] ? __init_kthread_worker+0x55/0x55
 [] ? gs_change+0x13/0x13

Signed-off-by: Andre Guedes 
Signed-off-by: Vinicius Costa Gomes 
Reviewed-by: Ulisses Furquim 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: silence lockdep warning

2012-02-15T11:09:26+00:00

Since bluetooth uses multiple protocols types, to avoid lockdep
warnings, we need to use different lockdep classes (one for each
protocol type).

This is already done in bt_sock_create but it misses a couple of cases
when new connections are created. This patch corrects that to fix the
following warning:

<4>[ 1864.732366] =======================================================
<4>[ 1864.733030] [ INFO: possible circular locking dependency detected ]
<4>[ 1864.733544] 3.0.16-mid3-00007-gc9a0f62 #3
<4>[ 1864.733883] -------------------------------------------------------
<4>[ 1864.734408] t.android.btclc/4204 is trying to acquire lock:
<4>[ 1864.734869]  (rfcomm_mutex){+.+.+.}, at: [] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.735541]
<4>[ 1864.735549] but task is already holding lock:
<4>[ 1864.736045]  (sk_lock-AF_BLUETOOTH){+.+.+.}, at: [] lock_sock+0xa/0xc
<4>[ 1864.736732]
<4>[ 1864.736740] which lock already depends on the new lock.
<4>[ 1864.736750]
<4>[ 1864.737428]
<4>[ 1864.737437] the existing dependency chain (in reverse order) is:
<4>[ 1864.738016]
<4>[ 1864.738023] -> #1 (sk_lock-AF_BLUETOOTH){+.+.+.}:
<4>[ 1864.738549]        [] lock_acquire+0x104/0x140
<4>[ 1864.738977]        [] lock_sock_nested+0x58/0x68
<4>[ 1864.739411]        [] l2cap_sock_sendmsg+0x3e/0x76
<4>[ 1864.739858]        [] __sock_sendmsg+0x50/0x59
<4>[ 1864.740279]        [] sock_sendmsg+0x94/0xa8
<4>[ 1864.740687]        [] kernel_sendmsg+0x28/0x37
<4>[ 1864.741106]        [] rfcomm_send_frame+0x30/0x38
<4>[ 1864.741542]        [] rfcomm_send_ua+0x58/0x5a
<4>[ 1864.741959]        [] rfcomm_run+0x441/0xb52
<4>[ 1864.742365]        [] kthread+0x63/0x68
<4>[ 1864.742742]        [] kernel_thread_helper+0x6/0xd
<4>[ 1864.743187]
<4>[ 1864.743193] -> #0 (rfcomm_mutex){+.+.+.}:
<4>[ 1864.743667]        [] __lock_acquire+0x988/0xc00
<4>[ 1864.744100]        [] lock_acquire+0x104/0x140
<4>[ 1864.744519]        [] __mutex_lock_common+0x3b/0x33f
<4>[ 1864.744975]        [] mutex_lock_nested+0x2d/0x36
<4>[ 1864.745412]        [] rfcomm_dlc_close+0x15/0x30
<4>[ 1864.745842]        [] __rfcomm_sock_close+0x5f/0x6b
<4>[ 1864.746288]        [] rfcomm_sock_shutdown+0x2f/0x62
<4>[ 1864.746737]        [] sys_socketcall+0x1db/0x422
<4>[ 1864.747165]        [] syscall_call+0x7/0xb

Signed-off-by: Octavian Purdila 
Acked-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg