iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
50efc63d1a
linux/drivers
History
Ying Hsu 769bf60e17 Bluetooth: Fix deadlock in vhci_send_frame 
syzbot found a potential circular dependency leading to a deadlock:
    -> #3 (&hdev->req_lock){+.+.}-{3:3}:
    __mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599
    __mutex_lock kernel/locking/mutex.c:732 [inline]
    mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784
    hci_dev_do_close+0x3f/0x9f net/bluetooth/hci_core.c:551
    hci_rfkill_set_block+0x130/0x1ac net/bluetooth/hci_core.c:935
    rfkill_set_block+0x1e6/0x3b8 net/rfkill/core.c:345
    rfkill_fop_write+0x2d8/0x672 net/rfkill/core.c:1274
    vfs_write+0x277/0xcf5 fs/read_write.c:594
    ksys_write+0x19b/0x2bd fs/read_write.c:650
    do_syscall_x64 arch/x86/entry/common.c:55 [inline]
    do_syscall_64+0x51/0xba arch/x86/entry/common.c:93
    entry_SYSCALL_64_after_hwframe+0x61/0xcb

    -> #2 (rfkill_global_mutex){+.+.}-{3:3}:
    __mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599
    __mutex_lock kernel/locking/mutex.c:732 [inline]
    mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784
    rfkill_register+0x30/0x7e3 net/rfkill/core.c:1045
    hci_register_dev+0x48f/0x96d net/bluetooth/hci_core.c:2622
    __vhci_create_device drivers/bluetooth/hci_vhci.c:341 [inline]
    vhci_create_device+0x3ad/0x68f drivers/bluetooth/hci_vhci.c:374
    vhci_get_user drivers/bluetooth/hci_vhci.c:431 [inline]
    vhci_write+0x37b/0x429 drivers/bluetooth/hci_vhci.c:511
    call_write_iter include/linux/fs.h:2109 [inline]
    new_sync_write fs/read_write.c:509 [inline]
    vfs_write+0xaa8/0xcf5 fs/read_write.c:596
    ksys_write+0x19b/0x2bd fs/read_write.c:650
    do_syscall_x64 arch/x86/entry/common.c:55 [inline]
    do_syscall_64+0x51/0xba arch/x86/entry/common.c:93
    entry_SYSCALL_64_after_hwframe+0x61/0xcb

    -> #1 (&data->open_mutex){+.+.}-{3:3}:
    __mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599
    __mutex_lock kernel/locking/mutex.c:732 [inline]
    mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784
    vhci_send_frame+0x68/0x9c drivers/bluetooth/hci_vhci.c:75
    hci_send_frame+0x1cc/0x2ff net/bluetooth/hci_core.c:2989
    hci_sched_acl_pkt net/bluetooth/hci_core.c:3498 [inline]
    hci_sched_acl net/bluetooth/hci_core.c:3583 [inline]
    hci_tx_work+0xb94/0x1a60 net/bluetooth/hci_core.c:3654
    process_one_work+0x901/0xfb8 kernel/workqueue.c:2310
    worker_thread+0xa67/0x1003 kernel/workqueue.c:2457
    kthread+0x36a/0x430 kernel/kthread.c:319
    ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

    -> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}:
    check_prev_add kernel/locking/lockdep.c:3053 [inline]
    check_prevs_add kernel/locking/lockdep.c:3172 [inline]
    validate_chain kernel/locking/lockdep.c:3787 [inline]
    __lock_acquire+0x2d32/0x77fa kernel/locking/lockdep.c:5011
    lock_acquire+0x273/0x4d5 kernel/locking/lockdep.c:5622
    __flush_work+0xee/0x19f kernel/workqueue.c:3090
    hci_dev_close_sync+0x32f/0x1113 net/bluetooth/hci_sync.c:4352
    hci_dev_do_close+0x47/0x9f net/bluetooth/hci_core.c:553
    hci_rfkill_set_block+0x130/0x1ac net/bluetooth/hci_core.c:935
    rfkill_set_block+0x1e6/0x3b8 net/rfkill/core.c:345
    rfkill_fop_write+0x2d8/0x672 net/rfkill/core.c:1274
    vfs_write+0x277/0xcf5 fs/read_write.c:594
    ksys_write+0x19b/0x2bd fs/read_write.c:650
    do_syscall_x64 arch/x86/entry/common.c:55 [inline]
    do_syscall_64+0x51/0xba arch/x86/entry/common.c:93
    entry_SYSCALL_64_after_hwframe+0x61/0xcb

This change removes the need for acquiring the open_mutex in
vhci_send_frame, thus eliminating the potential deadlock while
maintaining the required packet ordering.

Fixes: 92d4abd66f ("Bluetooth: vhci: Fix race when opening vhci device")
Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2023-12-15 11:29:16 -05:00
..
accel accel/ivpu/37xx: Fix hangs related to MMIO reset 2023-11-21 09:20:25 +01:00
accessibility
acpi ACPI: utils: Fix error path in acpi_evaluate_reference() 2023-12-07 21:38:21 +01:00
amba amba: bus: balance firmware node reference counting 2023-10-17 13:37:35 -05:00
android Char/Misc and other driver changes for 6.7-rc1 2023-11-03 14:51:08 -10:00
ata SCSI fixes on 20231130 2023-12-02 06:27:20 +09:00
atm atm: solos-pci: Fix potential deadlock on &tx_queue_lock 2023-12-09 21:17:45 +00:00
auxdisplay
base Char/Misc driver fixes for 6.7-rc5 2023-12-09 12:44:10 -08:00
bcma
block nbd: pass nbd_sock to nbd_read_reply() instead of index 2023-11-21 07:42:04 -07:00
bluetooth Bluetooth: Fix deadlock in vhci_send_frame 2023-12-15 11:29:16 -05:00
bus SoC driver updates for 6.7 2023-11-01 14:46:51 -10:00
cache riscv: RISCV_NONSTANDARD_CACHE_OPS shouldn't depend on RISCV_DMA_NONCOHERENT 2023-10-26 09:42:37 +02:00
cdrom
cdx Char/Misc and other driver changes for 6.7-rc1 2023-11-03 14:51:08 -10:00
char Char/Misc and other driver changes for 6.7-rc1 2023-11-03 14:51:08 -10:00
clk SoC driver updates for 6.7 2023-11-01 14:46:51 -10:00
clocksource RISC-V Patches for the 6.7 Merge Window, Part 2 2023-11-10 09:23:17 -08:00
comedi
connector Fix NULL pointer dereference in cn_filter() 2023-10-24 10:53:45 +02:00
counter
cpufreq cpufreq/amd-pstate: Only print supported EPP values for performance governor 2023-11-29 22:04:15 +01:00
cpuidle
crypto crypto: talitos - stop using crypto_ahash::init 2023-10-27 18:04:29 +08:00
cxl cxl/pci: Change CXL AER support check to use native AER 2023-11-02 14:09:01 -07:00
dax Many singleton patches against the MM code. The patch series which are 2023-11-02 19:38:47 -10:00
dca
devfreq PM / devfreq: rockchip-dfi: add support for RK3588 2023-10-19 21:21:16 +09:00
dio
dma dmaengine updates for v6.7 2023-11-03 18:56:51 -10:00
dma-buf dma-buf: fix check in dma_resv_add_fence 2023-11-27 20:00:47 +01:00
dpll dpll: sanitize possible null pointer dereference in dpll_pin_parent_pin_set() 2023-12-12 16:20:54 -08:00
edac hardening updates for v6.7-rc1 2023-10-30 19:09:55 -10:00
eisa
extcon extcon: realtek: add the error handler for nvmem_cell_read 2023-10-17 17:38:57 +09:00
firewire firewire fixes for 6.7-rc4 2023-12-03 09:03:07 +09:00
firmware EFI fixes for v6.7 #2 2023-12-13 10:54:50 -08:00
fpga Char/Misc and other driver changes for 6.7-rc1 2023-11-03 14:51:08 -10:00
fsi
gnss
gpio gpiolib: sysfs: Fix error handling on failed export 2023-12-01 10:44:48 +01:00
gpu Two fixups 2023-12-08 13:55:32 +10:00
greybus Revert "greybus: gb-beagleplay: Ensure le for values in transport" 2023-12-05 09:10:01 +09:00
hid hid-for-linus-2023121201 2023-12-12 17:02:56 -08:00
hsi
hte hte: Changes for v6.7-rc1 2023-10-31 18:32:51 -10:00
hv TTY/Serial changes for 6.7-rc1 2023-11-03 15:44:25 -10:00
hwmon hwmon: (corsair-psu) Fix probe when built-in 2023-12-08 10:36:02 -08:00
hwspinlock
hwtracing coresight: ultrasoc-smb: Fix uninitialized before use buf_hw_base 2023-11-16 10:00:14 +00:00
i2c i2c: ocores: Move system PM hooks to the NOIRQ phase 2023-11-13 12:43:42 -05:00
i3c I3C for 6.7 2023-11-04 16:25:36 -10:00
idle
iio Char/Misc and other driver changes for 6.7-rc1 2023-11-03 14:51:08 -10:00
infiniband RDMA/irdma: Avoid free the non-cqp_request scratch 2023-12-04 20:02:41 -04:00
input Input updates for 6.7 merge window: 2023-11-09 14:18:42 -08:00
interconnect Merge branch 'icc-platform-remove' into icc-next 2023-10-19 00:50:03 +03:00
iommu iommufd 6.7 first rc pull request 2023-12-05 06:54:52 +09:00
ipack
irqchip - Flush the translation service tables to prevent unpredictable behavior 2023-11-19 13:49:32 -08:00
isdn hardening updates for v6.7-rc1 2023-10-30 19:09:55 -10:00
leds leds: trigger: netdev: fix RTNL handling to prevent potential deadlock 2023-12-06 07:36:55 -08:00
macintosh powerpc updates for 6.7 2023-11-03 10:07:39 -10:00
mailbox Moving repo 2023-11-05 18:45:32 -08:00
mcb mcb: fix error handling for different scenarios when parsing 2023-10-21 23:04:02 +02:00
md block-6.7-2023-12-08 2023-12-08 12:36:45 -08:00
media Renesas R-Car VSP1 driver regression fix 2023-11-16 14:28:44 +01:00
memory IOMMU Updates for Linux v6.7 2023-11-09 13:37:28 -08:00
memstick
message scsi: message: fusion: Initialize return value in mptfc_bus_reset() 2023-10-24 22:36:39 -04:00
mfd - Core Frameworks 2023-11-02 14:40:51 -10:00
misc misc: mei: client.c: fix problem of return '-EOVERFLOW' in mei_cl_write 2023-11-27 13:38:29 +00:00
mmc mmc: sdhci-sprd: Fix vqmmc not shutting down after the card was pulled 2023-11-23 18:04:17 +01:00
most
mtd - removed AR7 platform support 2023-11-10 09:19:46 -08:00
mux
net ethernet: atheros: fix a memleak in atl1e_setup_ring_resources 2023-12-15 10:55:35 +00:00
nfc nfc: virtual_ncidev: Add variable to check if ndev is running 2023-11-22 10:55:48 +00:00
ntb
nubus
nvdimm libnvdimm: remove kernel-doc warnings: 2023-10-18 09:48:05 -07:00
nvme nvme-pci: Add sleep quirk for Kingston drives 2023-12-07 08:53:20 -08:00
nvmem nvmem: Do not expect fixed layouts to grab a layout driver 2023-12-07 11:19:32 +09:00
of Devicetree fixes for v6.7, take 1: 2023-12-07 12:22:36 -08:00
opp OPP: No need to defer probe from _opp_attach_genpd() 2023-10-17 11:11:28 +05:30
parisc parisc/power: Fix power soft-off when running on qemu 2023-11-18 18:59:30 +01:00
parport parport: Add support for Brainboxes IX/UC/PX parallel cards 2023-12-07 11:10:44 +09:00
pci cxl for v6.7 2023-11-04 16:20:36 -10:00
pcmcia PCMCIA odd cleanups and fixes for v6.7-rc1 2023-11-07 16:40:42 -08:00
peci
perf arm64 fixes: 2023-11-10 12:22:14 -08:00
phy Revert "phy: realtek: usb: Add driver for the Realtek SoC USB 2.0 PHY" 2023-11-06 14:47:36 +01:00
pinctrl pinctrl: realtek: Fix logical error when finding descriptor 2023-11-24 10:39:20 +01:00
platform platform/mellanox: Check devm_hwmon_device_register_with_groups() return value 2023-12-04 15:01:46 +02:00
pmdomain Power management fixes for 6.7-rc4 2023-12-02 09:01:00 +09:00
pnp PNP: replace deprecated strncpy() with memcpy() 2023-10-20 19:50:40 +02:00
power USB/Thunderbolt changes for 6.7-rc1 2023-11-03 16:00:42 -10:00
powercap powercap: DTPM: Fix missing cpufreq_cpu_put() calls 2023-12-05 20:51:24 +01:00
pps
ps3
ptp ptp: annotate data-race around q->head and q->tail 2023-11-13 20:51:37 -08:00
pwm pwm: bcm2835: Fix NPD in suspend/resume 2023-11-21 11:09:32 +01:00
rapidio
ras
regulator regulator: Merge up pending fix 2023-10-30 13:14:27 +00:00
remoteproc remoteproc: st: Fix sometimes uninitialized ret in st_rproc_probe() 2023-10-16 11:24:34 -06:00
reset reset: Annotate struct reset_control_array with __counted_by 2023-10-24 14:10:04 -07:00
rpmsg rpmsg: virtio: Replace deprecated strncpy with strscpy/_pad 2023-10-23 13:11:07 -06:00
rtc RTC for 6.7 2023-11-05 18:49:40 -08:00
s390 block-6.7-2023-11-23 2023-11-23 17:40:15 -08:00
sbus
scsi scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle() 2023-12-05 20:38:26 -05:00
sh sh: Remove superhyway bus support 2023-10-25 16:50:11 +02:00
siox
slimbus
soc powerpc updates for 6.7 2023-11-03 10:07:39 -10:00
soundwire soundwire updates for 6.7 2023-11-03 19:10:41 -10:00
spi spi: Fixes for v6.7 2023-11-10 11:44:38 -08:00
spmi spmi: rename spmi device lookup helper 2023-11-01 10:02:18 +00:00
ssb ssb: relax SSB_EMBEDDED dependencies 2023-10-19 10:26:26 +03:00
staging pwm: Changes for v6.7-rc1 2023-11-09 13:47:52 -08:00
target SCSI misc on 20231102 2023-11-02 15:13:50 -10:00
tc
tee OP-TEE fix for supplicant based device enumeration 2023-12-06 16:15:26 +01:00
thermal Thermal control updates for 6.7-rc1 2023-10-31 15:28:37 -10:00
thunderbolt thunderbolt: Only add device router DP IN to the head of the DP resource list 2023-11-17 13:05:57 +02:00
tty serial: 8250_dw: Add ACPI ID for Granite Rapids-D UART 2023-12-07 10:48:56 +09:00
ufs scsi: ufs: core: Clear cmd if abort succeeds in MCQ mode 2023-11-24 20:35:24 -05:00
uio
usb usb: gadget: f_hid: fix report descriptor allocation 2023-12-07 10:12:05 +09:00
vdpa pds_vdpa: set features order 2023-12-01 09:55:01 -05:00
vfio vfio/pds: Fix possible sleep while in atomic context 2023-11-27 09:29:03 -07:00
vhost vhost,virtio,vdpa,firmware: bugfixes 2023-11-16 07:39:37 -05:00
video fbdev: fsl-diu-fb: mark wr_reg_wa() static 2023-11-10 09:16:02 +01:00
virt configfs-tsm for v6.7 2023-11-04 15:58:13 -10:00
virtio vhost,virtio,vdpa,firmware: bugfixes 2023-11-16 07:39:37 -05:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2023-10-21 19:19:06 +02:00
watchdog - removed AR7 platform support 2023-11-10 09:19:46 -08:00
xen xen/events: fix error code in xen_bind_pirq_msi_to_irq() 2023-11-28 12:48:27 +01:00
zorro
Kconfig - removed AR7 platform support 2023-11-10 09:19:46 -08:00
Makefile - removed AR7 platform support 2023-11-10 09:19:46 -08:00