Commit 0b27a4b9 authored Dec 03, 2012 by Gustavo Padovan

Revert "Bluetooth: Fix possible deadlock in SCO code"



This reverts commit 269c4845.

The commit was causing dead locks and NULL dereferences in the sco code:

 [28084.104013] BUG: soft lockup - CPU#0 stuck for 22s! [kworker/u:0H:7]
 [28084.104021] Modules linked in: btusb bluetooth <snip [last unloaded:
bluetooth]
...
 [28084.104021]  [<c160246d>] _raw_spin_lock+0xd/0x10
 [28084.104021]  [<f920e708>] sco_conn_del+0x58/0x1b0 [bluetooth]
 [28084.104021]  [<f920f1a9>] sco_connect_cfm+0xb9/0x2b0 [bluetooth]
 [28084.104021]  [<f91ef289>]
hci_sync_conn_complete_evt.isra.94+0x1c9/0x260 [bluetooth]
 [28084.104021]  [<f91f1a8d>] hci_event_packet+0x74d/0x2b40 [bluetooth]
 [28084.104021]  [<c1501abd>] ? __kfree_skb+0x3d/0x90
 [28084.104021]  [<c1501b46>] ? kfree_skb+0x36/0x90
 [28084.104021]  [<f91fcb4e>] ? hci_send_to_monitor+0x10e/0x190 [bluetooth]
 [28084.104021]  [<f91fcb4e>] ? hci_send_to_monitor+0x10e/0x190 [bluetooth]

Cc: stable@vger.kernel.org
Reported-by: Chan-yeol Park <chanyeol.park@gmail.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>

parent f2592d3e

net/bluetooth/sco.c

+10 −9

Original line number	Original line	Diff line number	Diff line
	@@ -131,15 +131,6 @@ static int sco_conn_del(struct hci_conn *hcon, int err)
	sco_sock_clear_timer(sk);		sco_sock_clear_timer(sk);
	sco_chan_del(sk, err);		sco_chan_del(sk, err);
	bh_unlock_sock(sk);		bh_unlock_sock(sk);

	sco_conn_lock(conn);
	conn->sk = NULL;
	sco_pi(sk)->conn = NULL;
	sco_conn_unlock(conn);

	if (conn->hcon)
	hci_conn_put(conn->hcon);

	sco_sock_kill(sk);		sco_sock_kill(sk);
	}		}

	@@ -885,6 +876,16 @@ static void sco_chan_del(struct sock *sk, int err)

	BT_DBG("sk %p, conn %p, err %d", sk, conn, err);		BT_DBG("sk %p, conn %p, err %d", sk, conn, err);

			if (conn) {
			sco_conn_lock(conn);
			conn->sk = NULL;
			sco_pi(sk)->conn = NULL;
			sco_conn_unlock(conn);

			if (conn->hcon)
			hci_conn_put(conn->hcon);
			}

	sk->sk_state = BT_CLOSED;		sk->sk_state = BT_CLOSED;
	sk->sk_err = err;		sk->sk_err = err;
	sk->sk_state_change(sk);		sk->sk_state_change(sk);