From patchwork Thu Mar 20 18:25:28 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Felipe Balbi X-Patchwork-Id: 26754 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-yh0-f72.google.com (mail-yh0-f72.google.com [209.85.213.72]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id B4B05202E0 for ; Thu, 20 Mar 2014 18:27:28 +0000 (UTC) Received: by mail-yh0-f72.google.com with SMTP id f10sf3221160yha.7 for ; Thu, 20 Mar 2014 11:27:28 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:delivered-to:date:from:to:cc:subject:message-id :reply-to:references:mime-version:content-type:content-disposition :in-reply-to:user-agent:sender:precedence:list-id:x-original-sender :x-original-authentication-results:mailing-list:list-post:list-help :list-archive:list-unsubscribe; bh=HFbsqEk0aAOtrhBmpsqhtFl73gbbX5BZfsEg2DgJKzQ=; b=koHH+7xCufDpY4KG6rvZR6nfeEmMJjcdObMp8uu74YNDWNiAnE0uFNjLdVvDpIfgdL TG7fcCrgJBZDh3cohbf4LFxP4VBCctyprp7YIo1rfuvHogvyKLVLBTSJt9emhsFkyEwC lTv8FxJL5QpC7y5nAsLMmi2LUU07YU3PS1Hxu1U4dIWRLIAabOMnEUAP/epqoB6EYVog EivCl47tR64d8aaAc68El6ipfDMiU3Wx7fmTJDq7Zre051r0tbDj4t9HqCuVi4AtGsx/ rbN2UhjTZxyKcG1i4+v/GhDoAzBmreBpYlYpQ9zABLRKuKPceleFtYFSsXQjfXc5l61u u5xw== X-Gm-Message-State: ALoCoQkse5+5TUgsHineMsifSNHopj55thtfPkHTAaGuIDFhWzuF5uwVowJ3P5QrYGzgwKzrEgnc X-Received: by 10.224.20.133 with SMTP id f5mr17731871qab.8.1395340048443; Thu, 20 Mar 2014 11:27:28 -0700 (PDT) X-BeenThere: patchwork-forward@linaro.org Received: by 10.140.22.167 with SMTP id 36ls339564qgn.55.gmail; Thu, 20 Mar 2014 11:27:28 -0700 (PDT) X-Received: by 10.52.139.237 with SMTP id rb13mr4985475vdb.33.1395340048365; Thu, 20 Mar 2014 11:27:28 -0700 (PDT) Received: from mail-vc0-f180.google.com (mail-vc0-f180.google.com [209.85.220.180]) by mx.google.com with ESMTPS id tz5si610675vdc.187.2014.03.20.11.27.28 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 20 Mar 2014 11:27:28 -0700 (PDT) Received-SPF: neutral (google.com: 209.85.220.180 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) client-ip=209.85.220.180; Received: by mail-vc0-f180.google.com with SMTP id lf12so1446374vcb.11 for ; Thu, 20 Mar 2014 11:27:28 -0700 (PDT) X-Received: by 10.52.108.164 with SMTP id hl4mr7010864vdb.25.1395340048195; Thu, 20 Mar 2014 11:27:28 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.220.78.9 with SMTP id i9csp410013vck; Thu, 20 Mar 2014 11:27:27 -0700 (PDT) X-Received: by 10.66.251.42 with SMTP id zh10mr49470769pac.84.1395340045728; Thu, 20 Mar 2014 11:27:25 -0700 (PDT) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id nc6si1987821pbc.195.2014.03.20.11.27.25; Thu, 20 Mar 2014 11:27:25 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-serial-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758709AbaCTS1Y (ORCPT + 2 others); Thu, 20 Mar 2014 14:27:24 -0400 Received: from arroyo.ext.ti.com ([192.94.94.40]:45364 "EHLO arroyo.ext.ti.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751685AbaCTS1X (ORCPT ); Thu, 20 Mar 2014 14:27:23 -0400 Received: from dlelxv90.itg.ti.com ([172.17.2.17]) by arroyo.ext.ti.com (8.13.7/8.13.7) with ESMTP id s2KIRF5F017273; Thu, 20 Mar 2014 13:27:15 -0500 Received: from DFLE73.ent.ti.com (dfle73.ent.ti.com [128.247.5.110]) by dlelxv90.itg.ti.com (8.14.3/8.13.8) with ESMTP id s2KIRFT4002560; Thu, 20 Mar 2014 13:27:15 -0500 Received: from dlep32.itg.ti.com (157.170.170.100) by DFLE73.ent.ti.com (128.247.5.110) with Microsoft SMTP Server id 14.3.174.1; Thu, 20 Mar 2014 13:27:15 -0500 Received: from localhost (ileax41-snat.itg.ti.com [10.172.224.153]) by dlep32.itg.ti.com (8.14.3/8.13.8) with ESMTP id s2KIREMf029496; Thu, 20 Mar 2014 13:27:15 -0500 Date: Thu, 20 Mar 2014 13:25:28 -0500 From: Felipe Balbi To: Peter Hurley CC: , Marcel Holtmann , Alan Cox , Greg KH , Muralidharan Karicheri , , , Linux Kernel Mailing List , Huang Shijie Subject: Re: hci_ldsic nested locking problem Message-ID: <20140320182528.GE3959@saruman.home> Reply-To: References: <20140320163435.GH32692@saruman.home> <1395333736.22077.32.camel@acox1-desk.ger.corp.intel.com> <20140320171621.GA2827@saruman.home> <532B25FC.3070408@hurleysoftware.com> <20140320181145.GC3959@saruman.home> <532B319D.4090208@hurleysoftware.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <532B319D.4090208@hurleysoftware.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-serial-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: linux-serial@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: balbi@ti.com X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.220.180 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , On Thu, Mar 20, 2014 at 02:21:17PM -0400, Peter Hurley wrote: > On 03/20/2014 02:11 PM, Felipe Balbi wrote: > >On Thu, Mar 20, 2014 at 01:31:40PM -0400, Peter Hurley wrote: > >>[ +cc Huang Shijie ] > >> > >>On 03/20/2014 01:16 PM, Felipe Balbi wrote: > >>>On Thu, Mar 20, 2014 at 04:42:16PM +0000, Alan Cox wrote: > >>>>On Thu, 2014-03-20 at 11:34 -0500, Felipe Balbi wrote: > >>>>>Hi, > >>>>> > >>>>>when 8250 driver calls uart_write_wakeup(), the tty port lock is already > >>>>>taken. hci_ldisc.c's implementation of ->write_wakeup() calls > >>>>>tty->ops->write() to actually send the characters, but that call will > >>>>>try to acquire the same port lock again. > >>>>> > >>>>>Looking at other line disciplines that looks like a bug in hci_ldisc.c. > >>>>>Am I correct to assume that ->write_wakeup() is supposed to *just* > >>>>>wakeup the bottom half so we handle ->write() in another context ? > >>>>> > >>>>>Is it legal to call tty->ops->write() from within ->write_wakeup() ? > >>>> > >>>>It isn't because you might send all the bytes and go > >>>> > >>>> write > >>>> write_wakeup > >>>> write > >>>> write wakeup > >>>> ... > >>>> > >>>>and recurse > >>> > >>>cool, so there really is a bug in hci_ldisc. Marcel, any tips on how do > >>>you want this to be sorted out ? > >> > >>hci_uart_tx_wakeup() should perform the I/O as work. > >>FWIW, this was reported by Huang Shijie back on Dec 6. > >> > >>I'd fix it but I have no way to test it. > > > >here's a build-tested only patch which is waiting for testing from other > >colleagues who've got a platform to reproduce the problem: > > Where's the cancel_work_sync() on teardown? here, as a patch too this time: >From 3ee6b74833f154df64a6164476b854846206a3f2 Mon Sep 17 00:00:00 2001 From: Felipe Balbi Date: Thu, 20 Mar 2014 13:20:10 -0500 Subject: [PATCH] bluetooth: hci_ldisc: fix deadlock condition LDISCs shouldn't call tty->ops->write() from within ->write_wakeup(). ->write_wakeup() is called with port lock taken and IRQs disabled, tty->ops->write() will try to acquire the same port lock and we will deadlock. Signed-off-by: Felipe Balbi Reviewed-by: Peter Hurley Reported-by: Huang Shijie --- drivers/bluetooth/hci_ldisc.c | 20 +++++++++++++++----- drivers/bluetooth/hci_uart.h | 1 + 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 6e06f6f..ecdd765 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -118,10 +118,6 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu) int hci_uart_tx_wakeup(struct hci_uart *hu) { - struct tty_struct *tty = hu->tty; - struct hci_dev *hdev = hu->hdev; - struct sk_buff *skb; - if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) { set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); return 0; @@ -129,6 +125,18 @@ int hci_uart_tx_wakeup(struct hci_uart *hu) BT_DBG(""); + schedule_work(&hu->write_work); + + return 0; +} + +static void hci_uart_write_work(struct work_struct *work) +{ + struct hci_uart *hu = container_of(work, struct hci_uart, init_ready); + struct tty_struct *tty = hu->tty; + struct hci_dev *hdev = hu->hdev; + struct sk_buff *skb; + restart: clear_bit(HCI_UART_TX_WAKEUP, &hu->tx_state); @@ -153,7 +161,6 @@ restart: goto restart; clear_bit(HCI_UART_SENDING, &hu->tx_state); - return 0; } static void hci_uart_init_work(struct work_struct *work) @@ -281,6 +288,7 @@ static int hci_uart_tty_open(struct tty_struct *tty) tty->receive_room = 65536; INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); spin_lock_init(&hu->rx_lock); @@ -318,6 +326,8 @@ static void hci_uart_tty_close(struct tty_struct *tty) if (hdev) hci_uart_close(hdev); + cancel_work_sync(&hy->write_work); + if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) { if (hdev) { if (test_bit(HCI_UART_REGISTERED, &hu->flags)) diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h index fffa61f..12df101 100644 --- a/drivers/bluetooth/hci_uart.h +++ b/drivers/bluetooth/hci_uart.h @@ -68,6 +68,7 @@ struct hci_uart { unsigned long hdev_flags; struct work_struct init_ready; + struct work_struct write_work; struct hci_uart_proto *proto; void *priv;