| Message ID | 20230522143759.2880743-1-yinghsu@chromium.org |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Fix l2cap_disconnect_req deadlock | expand |
This is automated email and please do not reply to this email! Dear submitter, Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series: PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=749808 ---Test result--- Test Summary: CheckPatch PASS 0.72 seconds GitLint PASS 0.35 seconds SubjectPrefix FAIL 0.36 seconds BuildKernel PASS 32.39 seconds CheckAllWarning PASS 35.19 seconds CheckSparse PASS 39.93 seconds CheckSmatch PASS 111.87 seconds BuildKernel32 PASS 31.14 seconds TestRunnerSetup PASS 445.89 seconds TestRunner_l2cap-tester PASS 16.84 seconds TestRunner_iso-tester PASS 20.34 seconds TestRunner_bnep-tester PASS 5.39 seconds TestRunner_mgmt-tester PASS 111.90 seconds TestRunner_rfcomm-tester PASS 8.62 seconds TestRunner_sco-tester PASS 8.10 seconds TestRunner_ioctl-tester PASS 9.24 seconds TestRunner_mesh-tester PASS 6.83 seconds TestRunner_smp-tester PASS 7.85 seconds TestRunner_userchan-tester PASS 5.62 seconds IncrementalBuild PASS 29.53 seconds Details ############################## Test: SubjectPrefix - FAIL Desc: Check subject contains "Bluetooth" prefix Output: "Bluetooth: " prefix is not specified in the subject --- Regards, Linux Bluetooth
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 376b523c7b26..8f08192b8fb1 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -4651,8 +4651,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); - chan = l2cap_get_chan_by_scid(conn, dcid); + mutex_lock(&conn->chan_lock); + chan = __l2cap_get_chan_by_scid(conn, dcid); + if (chan) { + chan = l2cap_chan_hold_unless_zero(chan); + if (chan) + l2cap_chan_lock(chan); + } + if (!chan) { + mutex_unlock(&conn->chan_lock); cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); return 0; } @@ -4663,14 +4671,13 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, chan->ops->set_shutdown(chan); - mutex_lock(&conn->chan_lock); l2cap_chan_del(chan, ECONNRESET); - mutex_unlock(&conn->chan_lock); chan->ops->close(chan); l2cap_chan_unlock(chan); l2cap_chan_put(chan); + mutex_unlock(&conn->chan_lock); return 0; } @@ -4691,25 +4698,32 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); - chan = l2cap_get_chan_by_scid(conn, scid); + mutex_lock(&conn->chan_lock); + chan = __l2cap_get_chan_by_scid(conn, scid); + if (chan) { + chan = l2cap_chan_hold_unless_zero(chan); + if (chan) + l2cap_chan_lock(chan); + } if (!chan) { + mutex_unlock(&conn->chan_lock); return 0; } if (chan->state != BT_DISCONN) { l2cap_chan_unlock(chan); l2cap_chan_put(chan); + mutex_unlock(&conn->chan_lock); return 0; } - mutex_lock(&conn->chan_lock); l2cap_chan_del(chan, 0); - mutex_unlock(&conn->chan_lock); chan->ops->close(chan); l2cap_chan_unlock(chan); l2cap_chan_put(chan); + mutex_unlock(&conn->chan_lock); return 0; }
L2CAP assumes that the locks conn->chan_lock and chan->lock are acquired in the order conn->chan_lock, chan->lock to avoid potential deadlock. For example, l2sock_shutdown acquires these locks in the order: mutex_lock(&conn->chan_lock) l2cap_chan_lock(chan) However, l2cap_disconnect_req acquires chan->lock in l2cap_get_chan_by_scid first and then acquires conn->chan_lock before calling l2cap_chan_del. This means that these locks are acquired in unexpected order, which leads to potential deadlock: l2cap_chan_lock(c) mutex_lock(&conn->chan_lock) This patch uses __l2cap_get_chan_by_scid to replace l2cap_get_chan_by_scid and adjusts the locking order to avoid the potential deadlock. Signed-off-by: Ying Hsu <yinghsu@chromium.org> --- This commit has been tested on a Chromebook device. net/bluetooth/l2cap_core.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)