Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9ee77af authored by Sebastian Andrzej Siewior's avatar Sebastian Andrzej Siewior Committed by Marcel Holtmann
Browse files

Bluetooth: avoid recursive locking in hci_send_to_channel() 



Mart reported a deadlock in -RT in the call path:
  hci_send_monitor_ctrl_event() -> hci_send_to_channel()

because both functions acquire the same read lock hci_sk_list.lock. This
is also a mainline issue because the qrwlock implementation is writer
fair (the traditional rwlock implementation is reader biased).

To avoid the deadlock there is now __hci_send_to_channel() which expects
the readlock to be held.

Fixes: 38ceaa00 ("Bluetooth: Add support for sending MGMT commands and events to monitor")
Reported-by: default avatarMart van de Wege <mvdwege@gmail.com>
Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 1f01d8be

net/bluetooth/hci_sock.c

+11 −6
Original line number Diff line number Diff line
@@ -251,15 +251,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 
}



/* Send frame to sockets with specific channel */

void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,

static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb,

				  int flag, struct sock *skip_sk)

{

	struct sock *sk;



	BT_DBG("channel %u len %d", channel, skb->len);



	read_lock(&hci_sk_list.lock);



	sk_for_each(sk, &hci_sk_list.head) {

		struct sk_buff *nskb;
@@ -285,6 +283,13 @@ void hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 
			kfree_skb(nskb);

	}



}



void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,

			 int flag, struct sock *skip_sk)

{

	read_lock(&hci_sk_list.lock);

	__hci_send_to_channel(channel, skb, flag, skip_sk);

	read_unlock(&hci_sk_list.lock);

}
@@ -388,7 +393,7 @@ void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event, 
		hdr->index = index;

		hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);



		hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,

		__hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,

				      HCI_SOCK_TRUSTED, NULL);

		kfree_skb(skb);

	}