2007-02-09 22:24:33 +08:00
|
|
|
/*
|
2005-04-17 06:20:36 +08:00
|
|
|
BlueZ - Bluetooth protocol stack for Linux
|
|
|
|
|
Copyright (C) 2000-2001 Qualcomm Incorporated
|
|
|
|
|
|
|
|
|
|
Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
|
|
|
|
|
|
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
|
|
|
it under the terms of the GNU General Public License version 2 as
|
|
|
|
|
published by the Free Software Foundation;
|
|
|
|
|
|
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
|
|
|
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
|
|
|
|
|
IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
|
2007-02-09 22:24:33 +08:00
|
|
|
CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
|
|
|
|
|
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
|
|
|
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
2005-04-17 06:20:36 +08:00
|
|
|
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
|
|
2007-02-09 22:24:33 +08:00
|
|
|
ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
|
|
|
|
|
COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
|
2005-04-17 06:20:36 +08:00
|
|
|
SOFTWARE IS DISCLAIMED.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
/* Bluetooth SCO sockets. */
|
|
|
|
|
|
|
|
|
|
#include <linux/module.h>
|
2010-03-21 12:27:45 +08:00
|
|
|
#include <linux/debugfs.h>
|
|
|
|
|
#include <linux/seq_file.h>
|
2017-02-03 02:15:33 +08:00
|
|
|
#include <linux/sched/signal.h>
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
#include <net/bluetooth/bluetooth.h>
|
|
|
|
|
#include <net/bluetooth/hci_core.h>
|
|
|
|
|
#include <net/bluetooth/sco.h>
|
|
|
|
|
|
2011-12-19 22:08:01 +08:00
|
|
|
static bool disable_esco;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2005-12-23 04:49:22 +08:00
|
|
|
static const struct proto_ops sco_sock_ops;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
static struct bt_sock_list sco_sk_list = {
|
2008-03-29 07:17:38 +08:00
|
|
|
.lock = __RW_LOCK_UNLOCKED(sco_sk_list.lock)
|
2005-04-17 06:20:36 +08:00
|
|
|
};
|
|
|
|
|
|
2014-07-11 12:19:42 +08:00
|
|
|
/* ---- SCO connections ---- */
|
|
|
|
|
struct sco_conn {
|
|
|
|
|
struct hci_conn *hcon;
|
|
|
|
|
|
|
|
|
|
spinlock_t lock;
|
|
|
|
|
struct sock *sk;
|
|
|
|
|
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
struct delayed_work timeout_work;
|
|
|
|
|
|
2014-07-11 12:19:42 +08:00
|
|
|
unsigned int mtu;
|
|
|
|
|
};
|
|
|
|
|
|
2021-03-24 10:03:25 +08:00
|
|
|
#define sco_conn_lock(c) spin_lock(&c->lock)
|
|
|
|
|
#define sco_conn_unlock(c) spin_unlock(&c->lock)
|
2014-07-11 12:19:42 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
static void sco_sock_close(struct sock *sk);
|
|
|
|
|
static void sco_sock_kill(struct sock *sk);
|
|
|
|
|
|
2014-07-11 12:19:41 +08:00
|
|
|
/* ----- SCO socket info ----- */
|
|
|
|
|
#define sco_pi(sk) ((struct sco_pinfo *) sk)
|
|
|
|
|
|
|
|
|
|
struct sco_pinfo {
|
|
|
|
|
struct bt_sock bt;
|
|
|
|
|
bdaddr_t src;
|
|
|
|
|
bdaddr_t dst;
|
|
|
|
|
__u32 flags;
|
|
|
|
|
__u16 setting;
|
2020-06-12 03:50:41 +08:00
|
|
|
__u8 cmsg_mask;
|
2021-09-07 18:12:42 +08:00
|
|
|
struct bt_codec codec;
|
2014-07-11 12:19:41 +08:00
|
|
|
struct sco_conn *conn;
|
|
|
|
|
};
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
/* ---- SCO timers ---- */
|
2014-07-11 12:19:44 +08:00
|
|
|
#define SCO_CONN_TIMEOUT (HZ * 40)
|
|
|
|
|
#define SCO_DISCONN_TIMEOUT (HZ * 2)
|
|
|
|
|
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
static void sco_sock_timeout(struct work_struct *work)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
struct sco_conn *conn = container_of(work, struct sco_conn,
|
|
|
|
|
timeout_work.work);
|
|
|
|
|
struct sock *sk;
|
|
|
|
|
|
|
|
|
|
sco_conn_lock(conn);
|
|
|
|
|
sk = conn->sk;
|
|
|
|
|
if (sk)
|
|
|
|
|
sock_hold(sk);
|
|
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
|
|
|
|
|
if (!sk)
|
|
|
|
|
return;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("sock %p state %d", sk, sk->sk_state);
|
|
|
|
|
|
2021-08-10 12:14:07 +08:00
|
|
|
lock_sock(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
sk->sk_err = ETIMEDOUT;
|
|
|
|
|
sk->sk_state_change(sk);
|
2021-08-10 12:14:07 +08:00
|
|
|
release_sock(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
sock_put(sk);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void sco_sock_set_timer(struct sock *sk, long timeout)
|
|
|
|
|
{
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
if (!sco_pi(sk)->conn)
|
|
|
|
|
return;
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout);
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
|
|
|
|
|
schedule_delayed_work(&sco_pi(sk)->conn->timeout_work, timeout);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void sco_sock_clear_timer(struct sock *sk)
|
|
|
|
|
{
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
if (!sco_pi(sk)->conn)
|
|
|
|
|
return;
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
BT_DBG("sock %p state %d", sk, sk->sk_state);
|
Bluetooth: schedule SCO timeouts with delayed_work
struct sock.sk_timer should be used as a sock cleanup timer. However,
SCO uses it to implement sock timeouts.
This causes issues because struct sock.sk_timer's callback is run in
an IRQ context, and the timer callback function sco_sock_timeout takes
a spin lock on the socket. However, other functions such as
sco_conn_del and sco_conn_ready take the spin lock with interrupts
enabled.
This inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} lock usage could
lead to deadlocks as reported by Syzbot [1]:
CPU0
----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
<Interrupt>
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
To fix this, we use delayed work to implement SCO sock timouts
instead. This allows us to avoid taking the spin lock on the socket in
an IRQ context, and corrects the misuse of struct sock.sk_timer.
As a note, cancel_delayed_work is used instead of
cancel_delayed_work_sync in sco_sock_set_timer and
sco_sock_clear_timer to avoid a deadlock. In the future, the call to
bh_lock_sock inside sco_sock_timeout should be changed to lock_sock to
synchronize with other functions using lock_sock. However, since
sco_sock_set_timer and sco_sock_clear_timer are sometimes called under
the locked socket (in sco_connect and __sco_sock_close),
cancel_delayed_work_sync might cause them to sleep until an
sco_sock_timeout that has started finishes running. But
sco_sock_timeout would also sleep until it can grab the lock_sock.
Using cancel_delayed_work is fine because sco_sock_timeout does not
change from run to run, hence there is no functional difference
between:
1. waiting for a timeout to finish running before scheduling another
timeout
2. scheduling another timeout while a timeout is running.
Link: https://syzkaller.appspot.com/bug?id=9089d89de0502e120f234ca0fc8a703f7368b31e [1]
Reported-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Tested-by: syzbot+2f6d7c28bb4bf7e82060@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:05 +08:00
|
|
|
cancel_delayed_work(&sco_pi(sk)->conn->timeout_work);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* ---- SCO connections ---- */
|
2012-04-19 22:12:28 +08:00
|
|
|
static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct hci_dev *hdev = hcon->hdev;
|
2006-07-06 21:40:09 +08:00
|
|
|
struct sco_conn *conn = hcon->sco_data;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2012-04-19 22:12:28 +08:00
|
|
|
if (conn)
|
2005-04-17 06:20:36 +08:00
|
|
|
return conn;
|
|
|
|
|
|
2013-04-11 22:35:45 +08:00
|
|
|
conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
|
2006-07-06 21:40:09 +08:00
|
|
|
if (!conn)
|
2005-04-17 06:20:36 +08:00
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
spin_lock_init(&conn->lock);
|
2021-09-03 11:13:06 +08:00
|
|
|
INIT_DELAYED_WORK(&conn->timeout_work, sco_sock_timeout);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
hcon->sco_data = conn;
|
|
|
|
|
conn->hcon = hcon;
|
|
|
|
|
|
|
|
|
|
if (hdev->sco_mtu > 0)
|
|
|
|
|
conn->mtu = hdev->sco_mtu;
|
|
|
|
|
else
|
|
|
|
|
conn->mtu = 60;
|
|
|
|
|
|
|
|
|
|
BT_DBG("hcon %p conn %p", hcon, conn);
|
2006-07-06 21:40:09 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
return conn;
|
|
|
|
|
}
|
|
|
|
|
|
2014-07-14 01:54:49 +08:00
|
|
|
/* Delete channel.
|
|
|
|
|
* Must be called on the locked socket. */
|
|
|
|
|
static void sco_chan_del(struct sock *sk, int err)
|
|
|
|
|
{
|
|
|
|
|
struct sco_conn *conn;
|
|
|
|
|
|
|
|
|
|
conn = sco_pi(sk)->conn;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
|
|
|
|
|
|
|
|
|
|
if (conn) {
|
|
|
|
|
sco_conn_lock(conn);
|
|
|
|
|
conn->sk = NULL;
|
|
|
|
|
sco_pi(sk)->conn = NULL;
|
|
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
|
|
|
|
|
if (conn->hcon)
|
|
|
|
|
hci_conn_drop(conn->hcon);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sk->sk_state = BT_CLOSED;
|
|
|
|
|
sk->sk_err = err;
|
|
|
|
|
sk->sk_state_change(sk);
|
|
|
|
|
|
|
|
|
|
sock_set_flag(sk, SOCK_ZAPPED);
|
|
|
|
|
}
|
|
|
|
|
|
2015-08-19 09:23:01 +08:00
|
|
|
static void sco_conn_del(struct hci_conn *hcon, int err)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2010-12-01 22:58:22 +08:00
|
|
|
struct sco_conn *conn = hcon->sco_data;
|
2005-04-17 06:20:36 +08:00
|
|
|
struct sock *sk;
|
|
|
|
|
|
2010-12-01 22:58:22 +08:00
|
|
|
if (!conn)
|
2015-08-19 09:23:01 +08:00
|
|
|
return;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
|
|
|
|
|
|
|
|
|
|
/* Kill socket */
|
2014-07-14 07:30:15 +08:00
|
|
|
sco_conn_lock(conn);
|
|
|
|
|
sk = conn->sk;
|
2021-09-03 11:13:05 +08:00
|
|
|
if (sk)
|
|
|
|
|
sock_hold(sk);
|
2014-07-14 07:30:15 +08:00
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
|
2010-12-01 22:58:22 +08:00
|
|
|
if (sk) {
|
2021-08-10 12:14:07 +08:00
|
|
|
lock_sock(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
sco_sock_clear_timer(sk);
|
|
|
|
|
sco_chan_del(sk, err);
|
2021-08-10 12:14:07 +08:00
|
|
|
release_sock(sk);
|
2015-10-06 00:44:15 +08:00
|
|
|
sock_put(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2021-09-03 11:13:06 +08:00
|
|
|
/* Ensure no more work items will run before freeing conn. */
|
|
|
|
|
cancel_delayed_work_sync(&conn->timeout_work);
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
hcon->sco_data = NULL;
|
|
|
|
|
kfree(conn);
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static void __sco_chan_add(struct sco_conn *conn, struct sock *sk,
|
|
|
|
|
struct sock *parent)
|
2014-07-14 01:54:48 +08:00
|
|
|
{
|
|
|
|
|
BT_DBG("conn %p", conn);
|
|
|
|
|
|
|
|
|
|
sco_pi(sk)->conn = conn;
|
|
|
|
|
conn->sk = sk;
|
|
|
|
|
|
|
|
|
|
if (parent)
|
2019-01-03 08:11:20 +08:00
|
|
|
bt_accept_enqueue(parent, sk, true);
|
2014-07-14 01:54:48 +08:00
|
|
|
}
|
|
|
|
|
|
2012-05-23 15:04:18 +08:00
|
|
|
static int sco_chan_add(struct sco_conn *conn, struct sock *sk,
|
|
|
|
|
struct sock *parent)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
|
|
sco_conn_lock(conn);
|
2010-05-02 03:15:35 +08:00
|
|
|
if (conn->sk)
|
2005-04-17 06:20:36 +08:00
|
|
|
err = -EBUSY;
|
2010-05-02 03:15:35 +08:00
|
|
|
else
|
2005-04-17 06:20:36 +08:00
|
|
|
__sco_chan_add(conn, sk, parent);
|
2010-05-02 03:15:35 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
static int sco_connect(struct hci_dev *hdev, struct sock *sk)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sco_conn *conn;
|
|
|
|
|
struct hci_conn *hcon;
|
2007-10-20 20:55:10 +08:00
|
|
|
int err, type;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2013-10-14 01:34:01 +08:00
|
|
|
BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2008-07-15 02:13:53 +08:00
|
|
|
if (lmp_esco_capable(hdev) && !disable_esco)
|
|
|
|
|
type = ESCO_LINK;
|
|
|
|
|
else
|
|
|
|
|
type = SCO_LINK;
|
2007-10-20 20:55:10 +08:00
|
|
|
|
2013-08-19 20:24:01 +08:00
|
|
|
if (sco_pi(sk)->setting == BT_VOICE_TRANSPARENT &&
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
(!lmp_transp_capable(hdev) || !lmp_esco_capable(hdev)))
|
|
|
|
|
return -EOPNOTSUPP;
|
2013-08-19 20:24:01 +08:00
|
|
|
|
2013-10-14 01:34:01 +08:00
|
|
|
hcon = hci_connect_sco(hdev, type, &sco_pi(sk)->dst,
|
2021-09-07 18:12:43 +08:00
|
|
|
sco_pi(sk)->setting, &sco_pi(sk)->codec);
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
if (IS_ERR(hcon))
|
|
|
|
|
return PTR_ERR(hcon);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2012-04-19 22:12:28 +08:00
|
|
|
conn = sco_conn_add(hcon);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (!conn) {
|
2013-04-07 02:28:37 +08:00
|
|
|
hci_conn_drop(hcon);
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
return -ENOMEM;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Update source addr of the socket */
|
2013-10-14 01:34:01 +08:00
|
|
|
bacpy(&sco_pi(sk)->src, &hcon->src);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
err = sco_chan_add(conn, sk, NULL);
|
|
|
|
|
if (err)
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
return err;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
if (hcon->state == BT_CONNECTED) {
|
|
|
|
|
sco_sock_clear_timer(sk);
|
|
|
|
|
sk->sk_state = BT_CONNECTED;
|
|
|
|
|
} else {
|
|
|
|
|
sk->sk_state = BT_CONNECT;
|
|
|
|
|
sco_sock_set_timer(sk, sk->sk_sndtimeo);
|
|
|
|
|
}
|
2007-10-20 20:55:10 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2021-09-04 06:27:31 +08:00
|
|
|
static int sco_send_frame(struct sock *sk, struct sk_buff *skb)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sco_conn *conn = sco_pi(sk)->conn;
|
2021-09-17 04:10:49 +08:00
|
|
|
int len = skb->len;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Check outgoing MTU */
|
2021-09-17 04:10:49 +08:00
|
|
|
if (len > conn->mtu)
|
2005-04-17 06:20:36 +08:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
2021-09-17 04:10:49 +08:00
|
|
|
BT_DBG("sk %p len %d", sk, len);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2010-05-02 03:15:35 +08:00
|
|
|
hci_send_sco(conn->hcon, skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2021-09-17 04:10:49 +08:00
|
|
|
return len;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2012-05-23 15:04:18 +08:00
|
|
|
static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2014-07-14 07:30:15 +08:00
|
|
|
struct sock *sk;
|
|
|
|
|
|
|
|
|
|
sco_conn_lock(conn);
|
|
|
|
|
sk = conn->sk;
|
|
|
|
|
sco_conn_unlock(conn);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
if (!sk)
|
|
|
|
|
goto drop;
|
|
|
|
|
|
2021-06-03 15:41:04 +08:00
|
|
|
BT_DBG("sk %p len %u", sk, skb->len);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
if (sk->sk_state != BT_CONNECTED)
|
|
|
|
|
goto drop;
|
|
|
|
|
|
|
|
|
|
if (!sock_queue_rcv_skb(sk, skb))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
drop:
|
|
|
|
|
kfree_skb(skb);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* -------- Socket interface ---------- */
|
2012-04-19 20:37:58 +08:00
|
|
|
static struct sock *__sco_get_sock_listen_by_addr(bdaddr_t *ba)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2012-04-19 20:37:58 +08:00
|
|
|
struct sock *sk;
|
|
|
|
|
|
hlist: drop the node parameter from iterators
I'm not sure why, but the hlist for each entry iterators were conceived
list_for_each_entry(pos, head, member)
The hlist ones were greedy and wanted an extra parameter:
hlist_for_each_entry(tpos, pos, head, member)
Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.
Besides the semantic patch, there was some manual work required:
- Fix up the actual hlist iterators in linux/list.h
- Fix up the declaration of other iterators based on the hlist ones.
- A very small amount of places were using the 'node' parameter, this
was modified to use 'obj->member' instead.
- Coccinelle didn't handle the hlist_for_each_entry_safe iterator
properly, so those had to be fixed up manually.
The semantic patch which is mostly the work of Peter Senna Tschudin is here:
@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;
type T;
expression a,c,d,e;
identifier b;
statement S;
@@
-T b;
<+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
...+>
[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-02-28 09:06:00 +08:00
|
|
|
sk_for_each(sk, &sco_sk_list.head) {
|
2012-04-19 20:37:58 +08:00
|
|
|
if (sk->sk_state != BT_LISTEN)
|
|
|
|
|
continue;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2013-10-14 01:34:01 +08:00
|
|
|
if (!bacmp(&sco_pi(sk)->src, ba))
|
2012-04-19 20:37:58 +08:00
|
|
|
return sk;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return NULL;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Find socket listening on source bdaddr.
|
|
|
|
|
* Returns closest match.
|
|
|
|
|
*/
|
|
|
|
|
static struct sock *sco_get_sock_listen(bdaddr_t *src)
|
|
|
|
|
{
|
|
|
|
|
struct sock *sk = NULL, *sk1 = NULL;
|
|
|
|
|
|
|
|
|
|
read_lock(&sco_sk_list.lock);
|
|
|
|
|
|
hlist: drop the node parameter from iterators
I'm not sure why, but the hlist for each entry iterators were conceived
list_for_each_entry(pos, head, member)
The hlist ones were greedy and wanted an extra parameter:
hlist_for_each_entry(tpos, pos, head, member)
Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.
Besides the semantic patch, there was some manual work required:
- Fix up the actual hlist iterators in linux/list.h
- Fix up the declaration of other iterators based on the hlist ones.
- A very small amount of places were using the 'node' parameter, this
was modified to use 'obj->member' instead.
- Coccinelle didn't handle the hlist_for_each_entry_safe iterator
properly, so those had to be fixed up manually.
The semantic patch which is mostly the work of Peter Senna Tschudin is here:
@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;
type T;
expression a,c,d,e;
identifier b;
statement S;
@@
-T b;
<+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
...+>
[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-02-28 09:06:00 +08:00
|
|
|
sk_for_each(sk, &sco_sk_list.head) {
|
2005-04-17 06:20:36 +08:00
|
|
|
if (sk->sk_state != BT_LISTEN)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
/* Exact match. */
|
2013-10-14 01:34:01 +08:00
|
|
|
if (!bacmp(&sco_pi(sk)->src, src))
|
2005-04-17 06:20:36 +08:00
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
/* Closest match */
|
2013-10-14 01:34:01 +08:00
|
|
|
if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
|
2005-04-17 06:20:36 +08:00
|
|
|
sk1 = sk;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
read_unlock(&sco_sk_list.lock);
|
|
|
|
|
|
hlist: drop the node parameter from iterators
I'm not sure why, but the hlist for each entry iterators were conceived
list_for_each_entry(pos, head, member)
The hlist ones were greedy and wanted an extra parameter:
hlist_for_each_entry(tpos, pos, head, member)
Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.
Besides the semantic patch, there was some manual work required:
- Fix up the actual hlist iterators in linux/list.h
- Fix up the declaration of other iterators based on the hlist ones.
- A very small amount of places were using the 'node' parameter, this
was modified to use 'obj->member' instead.
- Coccinelle didn't handle the hlist_for_each_entry_safe iterator
properly, so those had to be fixed up manually.
The semantic patch which is mostly the work of Peter Senna Tschudin is here:
@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;
type T;
expression a,c,d,e;
identifier b;
statement S;
@@
-T b;
<+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
...+>
[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-02-28 09:06:00 +08:00
|
|
|
return sk ? sk : sk1;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void sco_sock_destruct(struct sock *sk)
|
|
|
|
|
{
|
|
|
|
|
BT_DBG("sk %p", sk);
|
|
|
|
|
|
|
|
|
|
skb_queue_purge(&sk->sk_receive_queue);
|
|
|
|
|
skb_queue_purge(&sk->sk_write_queue);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void sco_sock_cleanup_listen(struct sock *parent)
|
|
|
|
|
{
|
|
|
|
|
struct sock *sk;
|
|
|
|
|
|
|
|
|
|
BT_DBG("parent %p", parent);
|
|
|
|
|
|
|
|
|
|
/* Close not yet accepted channels */
|
|
|
|
|
while ((sk = bt_accept_dequeue(parent, NULL))) {
|
|
|
|
|
sco_sock_close(sk);
|
|
|
|
|
sco_sock_kill(sk);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
parent->sk_state = BT_CLOSED;
|
|
|
|
|
sock_set_flag(parent, SOCK_ZAPPED);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Kill socket (only if zapped and orphan)
|
|
|
|
|
* Must be called on unlocked socket.
|
|
|
|
|
*/
|
|
|
|
|
static void sco_sock_kill(struct sock *sk)
|
|
|
|
|
{
|
2021-08-10 12:14:10 +08:00
|
|
|
if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
|
2005-04-17 06:20:36 +08:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sk %p state %d", sk, sk->sk_state);
|
|
|
|
|
|
|
|
|
|
/* Kill poor orphan */
|
|
|
|
|
bt_sock_unlink(&sco_sk_list, sk);
|
|
|
|
|
sock_set_flag(sk, SOCK_DEAD);
|
|
|
|
|
sock_put(sk);
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
static void __sco_sock_close(struct sock *sk)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2009-06-16 06:01:49 +08:00
|
|
|
BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
switch (sk->sk_state) {
|
|
|
|
|
case BT_LISTEN:
|
|
|
|
|
sco_sock_cleanup_listen(sk);
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case BT_CONNECTED:
|
|
|
|
|
case BT_CONFIG:
|
2013-01-04 05:59:28 +08:00
|
|
|
if (sco_pi(sk)->conn->hcon) {
|
2011-05-12 16:13:15 +08:00
|
|
|
sk->sk_state = BT_DISCONN;
|
|
|
|
|
sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
|
2015-10-06 00:44:16 +08:00
|
|
|
sco_conn_lock(sco_pi(sk)->conn);
|
2013-04-07 02:28:37 +08:00
|
|
|
hci_conn_drop(sco_pi(sk)->conn->hcon);
|
2011-05-12 16:13:15 +08:00
|
|
|
sco_pi(sk)->conn->hcon = NULL;
|
2015-10-06 00:44:16 +08:00
|
|
|
sco_conn_unlock(sco_pi(sk)->conn);
|
2011-05-12 16:13:15 +08:00
|
|
|
} else
|
|
|
|
|
sco_chan_del(sk, ECONNRESET);
|
|
|
|
|
break;
|
|
|
|
|
|
2013-03-14 06:46:20 +08:00
|
|
|
case BT_CONNECT2:
|
2005-04-17 06:20:36 +08:00
|
|
|
case BT_CONNECT:
|
|
|
|
|
case BT_DISCONN:
|
|
|
|
|
sco_chan_del(sk, ECONNRESET);
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
default:
|
|
|
|
|
sock_set_flag(sk, SOCK_ZAPPED);
|
|
|
|
|
break;
|
2007-04-21 08:09:22 +08:00
|
|
|
}
|
2021-09-07 18:12:42 +08:00
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
/* Must be called on unlocked socket. */
|
|
|
|
|
static void sco_sock_close(struct sock *sk)
|
|
|
|
|
{
|
|
|
|
|
lock_sock(sk);
|
2021-08-10 12:14:08 +08:00
|
|
|
sco_sock_clear_timer(sk);
|
2009-06-16 06:01:49 +08:00
|
|
|
__sco_sock_close(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
release_sock(sk);
|
|
|
|
|
}
|
|
|
|
|
|
2020-06-12 03:50:41 +08:00
|
|
|
static void sco_skb_put_cmsg(struct sk_buff *skb, struct msghdr *msg,
|
|
|
|
|
struct sock *sk)
|
|
|
|
|
{
|
|
|
|
|
if (sco_pi(sk)->cmsg_mask & SCO_CMSG_PKT_STATUS)
|
|
|
|
|
put_cmsg(msg, SOL_BLUETOOTH, BT_SCM_PKT_STATUS,
|
|
|
|
|
sizeof(bt_cb(skb)->sco.pkt_status),
|
|
|
|
|
&bt_cb(skb)->sco.pkt_status);
|
|
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
static void sco_sock_init(struct sock *sk, struct sock *parent)
|
|
|
|
|
{
|
|
|
|
|
BT_DBG("sk %p", sk);
|
|
|
|
|
|
2011-10-07 17:40:59 +08:00
|
|
|
if (parent) {
|
2005-04-17 06:20:36 +08:00
|
|
|
sk->sk_type = parent->sk_type;
|
2012-11-21 17:51:12 +08:00
|
|
|
bt_sk(sk)->flags = bt_sk(parent)->flags;
|
2011-10-07 17:40:59 +08:00
|
|
|
security_sk_clone(parent, sk);
|
2020-06-12 03:50:41 +08:00
|
|
|
} else {
|
|
|
|
|
bt_sk(sk)->skb_put_cmsg = sco_skb_put_cmsg;
|
2011-10-07 17:40:59 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct proto sco_proto = {
|
|
|
|
|
.name = "SCO",
|
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
|
.obj_size = sizeof(struct sco_pinfo)
|
|
|
|
|
};
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static struct sock *sco_sock_alloc(struct net *net, struct socket *sock,
|
|
|
|
|
int proto, gfp_t prio, int kern)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk;
|
|
|
|
|
|
2015-05-09 10:09:13 +08:00
|
|
|
sk = sk_alloc(net, PF_BLUETOOTH, prio, &sco_proto, kern);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (!sk)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
sock_init_data(sock, sk);
|
|
|
|
|
INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
|
|
|
|
|
|
|
|
|
|
sk->sk_destruct = sco_sock_destruct;
|
|
|
|
|
sk->sk_sndtimeo = SCO_CONN_TIMEOUT;
|
|
|
|
|
|
|
|
|
|
sock_reset_flag(sk, SOCK_ZAPPED);
|
|
|
|
|
|
|
|
|
|
sk->sk_protocol = proto;
|
|
|
|
|
sk->sk_state = BT_OPEN;
|
|
|
|
|
|
2013-08-19 20:23:56 +08:00
|
|
|
sco_pi(sk)->setting = BT_VOICE_CVSD_16BIT;
|
2021-09-07 18:12:42 +08:00
|
|
|
sco_pi(sk)->codec.id = BT_CODEC_CVSD;
|
|
|
|
|
sco_pi(sk)->codec.cid = 0xffff;
|
|
|
|
|
sco_pi(sk)->codec.vid = 0xffff;
|
|
|
|
|
sco_pi(sk)->codec.data_path = 0x00;
|
2013-08-19 20:23:56 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
bt_sock_link(&sco_sk_list, sk);
|
|
|
|
|
return sk;
|
|
|
|
|
}
|
|
|
|
|
|
2009-11-06 14:18:14 +08:00
|
|
|
static int sco_sock_create(struct net *net, struct socket *sock, int protocol,
|
|
|
|
|
int kern)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sock %p", sock);
|
|
|
|
|
|
|
|
|
|
sock->state = SS_UNCONNECTED;
|
|
|
|
|
|
|
|
|
|
if (sock->type != SOCK_SEQPACKET)
|
|
|
|
|
return -ESOCKTNOSUPPORT;
|
|
|
|
|
|
|
|
|
|
sock->ops = &sco_sock_ops;
|
|
|
|
|
|
2015-05-09 10:09:13 +08:00
|
|
|
sk = sco_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
|
2006-10-15 23:31:14 +08:00
|
|
|
if (!sk)
|
2005-04-17 06:20:36 +08:00
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
sco_sock_init(sk, NULL);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static int sco_sock_bind(struct socket *sock, struct sockaddr *addr,
|
|
|
|
|
int addr_len)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
int err = 0;
|
|
|
|
|
|
2017-06-29 20:04:59 +08:00
|
|
|
if (!addr || addr_len < sizeof(struct sockaddr_sco) ||
|
|
|
|
|
addr->sa_family != AF_BLUETOOTH)
|
2015-12-16 04:39:08 +08:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
2019-04-12 18:54:33 +08:00
|
|
|
BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
if (sk->sk_state != BT_OPEN) {
|
|
|
|
|
err = -EBADFD;
|
|
|
|
|
goto done;
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-19 19:43:53 +08:00
|
|
|
if (sk->sk_type != SOCK_SEQPACKET) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
goto done;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2013-10-14 01:34:01 +08:00
|
|
|
bacpy(&sco_pi(sk)->src, &sa->sco_bdaddr);
|
2012-04-19 19:43:53 +08:00
|
|
|
|
|
|
|
|
sk->sk_state = BT_BOUND;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
done:
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
|
|
|
|
|
{
|
|
|
|
|
struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
|
|
|
|
|
struct sock *sk = sock->sk;
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
struct hci_dev *hdev;
|
2013-04-11 22:35:46 +08:00
|
|
|
int err;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("sk %p", sk);
|
|
|
|
|
|
2010-04-01 06:58:26 +08:00
|
|
|
if (alen < sizeof(struct sockaddr_sco) ||
|
|
|
|
|
addr->sa_family != AF_BLUETOOTH)
|
2005-04-17 06:20:36 +08:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
|
|
if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
|
|
|
|
|
return -EBADFD;
|
|
|
|
|
|
|
|
|
|
if (sk->sk_type != SOCK_SEQPACKET)
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
hdev = hci_get_route(&sa->sco_bdaddr, &sco_pi(sk)->src, BDADDR_BREDR);
|
|
|
|
|
if (!hdev)
|
|
|
|
|
return -EHOSTUNREACH;
|
|
|
|
|
hci_dev_lock(hdev);
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
/* Set destination address and psm */
|
2013-10-14 01:34:01 +08:00
|
|
|
bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
Bluetooth: avoid circular locks in sco_sock_connect
In a future patch, calls to bh_lock_sock in sco.c should be replaced
by lock_sock now that none of the functions are run in IRQ context.
However, doing so results in a circular locking dependency:
======================================================
WARNING: possible circular locking dependency detected
5.14.0-rc4-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.2/14867 is trying to acquire lock:
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
lock_sock include/net/sock.h:1613 [inline]
ffff88803e3c1120 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at:
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
but task is already holding lock:
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_disconn_cfm include/net/bluetooth/hci_core.h:1497 [inline]
ffffffff8d2dc7c8 (hci_cb_list_lock){+.+.}-{3:3}, at:
hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1608
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (hci_cb_list_lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
hci_connect_cfm include/net/bluetooth/hci_core.h:1482 [inline]
hci_remote_features_evt net/bluetooth/hci_event.c:3263 [inline]
hci_event_packet+0x2f4d/0x7c50 net/bluetooth/hci_event.c:6240
hci_rx_work+0x4f8/0xd30 net/bluetooth/hci_core.c:5122
process_one_work+0x98d/0x1630 kernel/workqueue.c:2276
worker_thread+0x658/0x11f0 kernel/workqueue.c:2422
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
-> #1 (&hdev->lock){+.+.}-{3:3}:
__mutex_lock_common kernel/locking/mutex.c:959 [inline]
__mutex_lock+0x12a/0x10a0 kernel/locking/mutex.c:1104
sco_connect net/bluetooth/sco.c:245 [inline]
sco_sock_connect+0x227/0xa10 net/bluetooth/sco.c:601
__sys_connect_file+0x155/0x1a0 net/socket.c:1879
__sys_connect+0x161/0x190 net/socket.c:1896
__do_sys_connect net/socket.c:1906 [inline]
__se_sys_connect net/socket.c:1903 [inline]
__x64_sys_connect+0x6f/0xb0 net/socket.c:1903
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
-> #0 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3051 [inline]
check_prevs_add kernel/locking/lockdep.c:3174 [inline]
validate_chain kernel/locking/lockdep.c:3789 [inline]
__lock_acquire+0x2a07/0x54a0 kernel/locking/lockdep.c:5015
lock_acquire kernel/locking/lockdep.c:5625 [inline]
lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590
lock_sock_nested+0xca/0x120 net/core/sock.c:3170
lock_sock include/net/sock.h:1613 [inline]
sco_conn_del+0x12a/0x2a0 net/bluetooth/sco.c:191
sco_disconn_cfm+0x71/0xb0 net/bluetooth/sco.c:1202
hci_disconn_cfm include/net/bluetooth/hci_core.h:1500 [inline]
hci_conn_hash_flush+0x127/0x260 net/bluetooth/hci_conn.c:1608
hci_dev_do_close+0x528/0x1130 net/bluetooth/hci_core.c:1778
hci_unregister_dev+0x1c0/0x5a0 net/bluetooth/hci_core.c:4015
vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
__fput+0x288/0x920 fs/file_table.c:280
task_work_run+0xdd/0x1a0 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xbd4/0x2a60 kernel/exit.c:825
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2808
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:288
other info that might help us debug this:
Chain exists of:
sk_lock-AF_BLUETOOTH-BTPROTO_SCO --> &hdev->lock --> hci_cb_list_lock
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hci_cb_list_lock);
lock(&hdev->lock);
lock(hci_cb_list_lock);
lock(sk_lock-AF_BLUETOOTH-BTPROTO_SCO);
*** DEADLOCK ***
The issue is that the lock hierarchy should go from &hdev->lock -->
hci_cb_list_lock --> sk_lock-AF_BLUETOOTH-BTPROTO_SCO. For example,
one such call trace is:
hci_dev_do_close():
hci_dev_lock();
hci_conn_hash_flush():
hci_disconn_cfm():
mutex_lock(&hci_cb_list_lock);
sco_disconn_cfm():
sco_conn_del():
lock_sock(sk);
However, in sco_sock_connect, we call lock_sock before calling
hci_dev_lock inside sco_connect, thus inverting the lock hierarchy.
We fix this by pulling the call to hci_dev_lock out from sco_connect.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2021-08-10 12:14:06 +08:00
|
|
|
err = sco_connect(hdev, sk);
|
|
|
|
|
hci_dev_unlock(hdev);
|
|
|
|
|
hci_dev_put(hdev);
|
2010-12-01 22:58:22 +08:00
|
|
|
if (err)
|
2005-04-17 06:20:36 +08:00
|
|
|
goto done;
|
|
|
|
|
|
2007-02-09 22:24:33 +08:00
|
|
|
err = bt_sock_wait_state(sk, BT_CONNECTED,
|
2012-05-17 11:36:21 +08:00
|
|
|
sock_sndtimeo(sk, flags & O_NONBLOCK));
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
done:
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int sco_sock_listen(struct socket *sock, int backlog)
|
|
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
2013-10-14 01:34:01 +08:00
|
|
|
bdaddr_t *src = &sco_pi(sk)->src;
|
2005-04-17 06:20:36 +08:00
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sk %p backlog %d", sk, backlog);
|
|
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
2012-04-19 19:43:52 +08:00
|
|
|
if (sk->sk_state != BT_BOUND) {
|
2005-04-17 06:20:36 +08:00
|
|
|
err = -EBADFD;
|
|
|
|
|
goto done;
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-19 19:43:52 +08:00
|
|
|
if (sk->sk_type != SOCK_SEQPACKET) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
goto done;
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-19 20:37:58 +08:00
|
|
|
write_lock(&sco_sk_list.lock);
|
|
|
|
|
|
|
|
|
|
if (__sco_get_sock_listen_by_addr(src)) {
|
|
|
|
|
err = -EADDRINUSE;
|
|
|
|
|
goto unlock;
|
|
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
sk->sk_max_ack_backlog = backlog;
|
|
|
|
|
sk->sk_ack_backlog = 0;
|
2012-04-19 20:37:58 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
sk->sk_state = BT_LISTEN;
|
|
|
|
|
|
2012-04-19 20:37:58 +08:00
|
|
|
unlock:
|
|
|
|
|
write_unlock(&sco_sk_list.lock);
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
done:
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static int sco_sock_accept(struct socket *sock, struct socket *newsock,
|
2017-03-09 16:09:05 +08:00
|
|
|
int flags, bool kern)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2015-01-24 01:16:53 +08:00
|
|
|
DEFINE_WAIT_FUNC(wait, woken_wake_function);
|
2005-04-17 06:20:36 +08:00
|
|
|
struct sock *sk = sock->sk, *ch;
|
|
|
|
|
long timeo;
|
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
|
|
|
|
|
|
|
|
|
|
BT_DBG("sk %p timeo %ld", sk, timeo);
|
|
|
|
|
|
|
|
|
|
/* Wait for an incoming connection. (wake-one). */
|
2010-04-20 21:03:51 +08:00
|
|
|
add_wait_queue_exclusive(sk_sleep(sk), &wait);
|
2011-07-24 12:11:01 +08:00
|
|
|
while (1) {
|
|
|
|
|
if (sk->sk_state != BT_LISTEN) {
|
|
|
|
|
err = -EBADFD;
|
2005-04-17 06:20:36 +08:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
2011-07-24 12:11:01 +08:00
|
|
|
ch = bt_accept_dequeue(sk, newsock);
|
|
|
|
|
if (ch)
|
|
|
|
|
break;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-07-24 12:11:01 +08:00
|
|
|
if (!timeo) {
|
|
|
|
|
err = -EAGAIN;
|
2005-04-17 06:20:36 +08:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (signal_pending(current)) {
|
|
|
|
|
err = sock_intr_errno(timeo);
|
|
|
|
|
break;
|
|
|
|
|
}
|
2011-07-24 12:11:01 +08:00
|
|
|
|
|
|
|
|
release_sock(sk);
|
2015-01-24 01:16:53 +08:00
|
|
|
|
|
|
|
|
timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
|
2011-07-24 12:11:01 +08:00
|
|
|
lock_sock(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
2010-04-20 21:03:51 +08:00
|
|
|
remove_wait_queue(sk_sleep(sk), &wait);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
if (err)
|
|
|
|
|
goto done;
|
|
|
|
|
|
|
|
|
|
newsock->state = SS_CONNECTED;
|
|
|
|
|
|
|
|
|
|
BT_DBG("new socket %p", ch);
|
|
|
|
|
|
|
|
|
|
done:
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static int sco_sock_getname(struct socket *sock, struct sockaddr *addr,
|
2018-02-13 03:00:20 +08:00
|
|
|
int peer)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sockaddr_sco *sa = (struct sockaddr_sco *) addr;
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sock %p, sk %p", sock, sk);
|
|
|
|
|
|
|
|
|
|
addr->sa_family = AF_BLUETOOTH;
|
|
|
|
|
|
|
|
|
|
if (peer)
|
2013-10-14 01:34:01 +08:00
|
|
|
bacpy(&sa->sco_bdaddr, &sco_pi(sk)->dst);
|
2005-04-17 06:20:36 +08:00
|
|
|
else
|
2013-10-14 01:34:01 +08:00
|
|
|
bacpy(&sa->sco_bdaddr, &sco_pi(sk)->src);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2018-02-13 03:00:20 +08:00
|
|
|
return sizeof(struct sockaddr_sco);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2015-03-02 15:37:48 +08:00
|
|
|
static int sco_sock_sendmsg(struct socket *sock, struct msghdr *msg,
|
|
|
|
|
size_t len)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
2021-09-04 06:27:31 +08:00
|
|
|
struct sk_buff *skb;
|
2010-05-02 03:15:35 +08:00
|
|
|
int err;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("sock %p, sk %p", sock, sk);
|
|
|
|
|
|
2005-12-14 15:22:19 +08:00
|
|
|
err = sock_error(sk);
|
|
|
|
|
if (err)
|
|
|
|
|
return err;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
if (msg->msg_flags & MSG_OOB)
|
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
|
2021-09-04 06:27:31 +08:00
|
|
|
skb = bt_skb_sendmsg(sk, msg, len, len, 0, 0);
|
2021-09-17 04:10:48 +08:00
|
|
|
if (IS_ERR(skb))
|
2021-09-04 06:27:31 +08:00
|
|
|
return PTR_ERR(skb);
|
2021-08-29 00:18:18 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
if (sk->sk_state == BT_CONNECTED)
|
2021-09-04 06:27:31 +08:00
|
|
|
err = sco_send_frame(sk, skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
else
|
|
|
|
|
err = -ENOTCONN;
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
2021-09-17 04:10:49 +08:00
|
|
|
|
|
|
|
|
if (err < 0)
|
2021-09-04 06:27:31 +08:00
|
|
|
kfree_skb(skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2013-08-19 20:23:58 +08:00
|
|
|
static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
|
2013-04-16 23:28:58 +08:00
|
|
|
{
|
|
|
|
|
struct hci_dev *hdev = conn->hdev;
|
|
|
|
|
|
|
|
|
|
BT_DBG("conn %p", conn);
|
|
|
|
|
|
|
|
|
|
conn->state = BT_CONFIG;
|
|
|
|
|
|
|
|
|
|
if (!lmp_esco_capable(hdev)) {
|
|
|
|
|
struct hci_cp_accept_conn_req cp;
|
|
|
|
|
|
|
|
|
|
bacpy(&cp.bdaddr, &conn->dst);
|
2013-08-19 20:23:55 +08:00
|
|
|
cp.role = 0x00; /* Ignored */
|
2013-04-16 23:28:58 +08:00
|
|
|
|
|
|
|
|
hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
|
|
|
|
|
} else {
|
|
|
|
|
struct hci_cp_accept_sync_conn_req cp;
|
|
|
|
|
|
|
|
|
|
bacpy(&cp.bdaddr, &conn->dst);
|
|
|
|
|
cp.pkt_type = cpu_to_le16(conn->pkt_type);
|
|
|
|
|
|
2014-03-13 01:52:35 +08:00
|
|
|
cp.tx_bandwidth = cpu_to_le32(0x00001f40);
|
|
|
|
|
cp.rx_bandwidth = cpu_to_le32(0x00001f40);
|
2013-08-19 20:23:58 +08:00
|
|
|
cp.content_format = cpu_to_le16(setting);
|
|
|
|
|
|
|
|
|
|
switch (setting & SCO_AIRMODE_MASK) {
|
|
|
|
|
case SCO_AIRMODE_TRANSP:
|
|
|
|
|
if (conn->pkt_type & ESCO_2EV3)
|
2014-03-13 01:52:35 +08:00
|
|
|
cp.max_latency = cpu_to_le16(0x0008);
|
2013-08-19 20:23:58 +08:00
|
|
|
else
|
2014-03-13 01:52:35 +08:00
|
|
|
cp.max_latency = cpu_to_le16(0x000D);
|
2013-08-19 20:23:58 +08:00
|
|
|
cp.retrans_effort = 0x02;
|
|
|
|
|
break;
|
|
|
|
|
case SCO_AIRMODE_CVSD:
|
2014-03-13 01:52:35 +08:00
|
|
|
cp.max_latency = cpu_to_le16(0xffff);
|
2013-08-19 20:23:58 +08:00
|
|
|
cp.retrans_effort = 0xff;
|
|
|
|
|
break;
|
2021-06-25 23:00:09 +08:00
|
|
|
default:
|
|
|
|
|
/* use CVSD settings as fallback */
|
|
|
|
|
cp.max_latency = cpu_to_le16(0xffff);
|
|
|
|
|
cp.retrans_effort = 0xff;
|
|
|
|
|
break;
|
2013-08-19 20:23:58 +08:00
|
|
|
}
|
2013-04-16 23:28:58 +08:00
|
|
|
|
|
|
|
|
hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
|
|
|
|
|
sizeof(cp), &cp);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2015-03-02 15:37:48 +08:00
|
|
|
static int sco_sock_recvmsg(struct socket *sock, struct msghdr *msg,
|
|
|
|
|
size_t len, int flags)
|
2012-11-21 17:51:12 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
struct sco_pinfo *pi = sco_pi(sk);
|
|
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
if (sk->sk_state == BT_CONNECT2 &&
|
|
|
|
|
test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
|
2013-08-19 20:23:58 +08:00
|
|
|
sco_conn_defer_accept(pi->conn->hcon, pi->setting);
|
2012-11-21 17:51:12 +08:00
|
|
|
sk->sk_state = BT_CONFIG;
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
|
2015-03-02 15:37:48 +08:00
|
|
|
return bt_sock_recvmsg(sock, msg, len, flags);
|
2012-11-21 17:51:12 +08:00
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static int sco_sock_setsockopt(struct socket *sock, int level, int optname,
|
2020-07-23 14:09:07 +08:00
|
|
|
sockptr_t optval, unsigned int optlen)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
2013-08-19 20:23:56 +08:00
|
|
|
int len, err = 0;
|
|
|
|
|
struct bt_voice voice;
|
2012-11-21 17:51:11 +08:00
|
|
|
u32 opt;
|
2021-09-07 18:12:42 +08:00
|
|
|
struct bt_codecs *codecs;
|
|
|
|
|
struct hci_dev *hdev;
|
|
|
|
|
__u8 buffer[255];
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("sk %p", sk);
|
|
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
switch (optname) {
|
2012-11-21 17:51:11 +08:00
|
|
|
|
|
|
|
|
case BT_DEFER_SETUP:
|
|
|
|
|
if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
2020-07-23 14:09:07 +08:00
|
|
|
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
|
2012-11-21 17:51:11 +08:00
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (opt)
|
|
|
|
|
set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
|
|
|
|
|
else
|
|
|
|
|
clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
|
|
|
|
|
break;
|
|
|
|
|
|
2013-08-19 20:23:56 +08:00
|
|
|
case BT_VOICE:
|
|
|
|
|
if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
|
|
|
|
|
sk->sk_state != BT_CONNECT2) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
voice.setting = sco_pi(sk)->setting;
|
|
|
|
|
|
|
|
|
|
len = min_t(unsigned int, sizeof(voice), optlen);
|
2020-07-23 14:09:07 +08:00
|
|
|
if (copy_from_sockptr(&voice, optval, len)) {
|
2013-08-19 20:23:56 +08:00
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Explicitly check for these values */
|
|
|
|
|
if (voice.setting != BT_VOICE_TRANSPARENT &&
|
|
|
|
|
voice.setting != BT_VOICE_CVSD_16BIT) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sco_pi(sk)->setting = voice.setting;
|
2021-09-07 18:12:43 +08:00
|
|
|
hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
|
|
|
|
|
BDADDR_BREDR);
|
|
|
|
|
if (!hdev) {
|
|
|
|
|
err = -EBADFD;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
if (enhanced_sco_capable(hdev) &&
|
|
|
|
|
voice.setting == BT_VOICE_TRANSPARENT)
|
|
|
|
|
sco_pi(sk)->codec.id = BT_CODEC_TRANSPARENT;
|
|
|
|
|
hci_dev_put(hdev);
|
2013-08-19 20:23:56 +08:00
|
|
|
break;
|
|
|
|
|
|
2020-06-12 03:50:41 +08:00
|
|
|
case BT_PKT_STATUS:
|
2020-08-01 07:15:03 +08:00
|
|
|
if (copy_from_sockptr(&opt, optval, sizeof(u32))) {
|
2020-06-12 03:50:41 +08:00
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (opt)
|
|
|
|
|
sco_pi(sk)->cmsg_mask |= SCO_CMSG_PKT_STATUS;
|
|
|
|
|
else
|
|
|
|
|
sco_pi(sk)->cmsg_mask &= SCO_CMSG_PKT_STATUS;
|
|
|
|
|
break;
|
|
|
|
|
|
2021-09-07 18:12:42 +08:00
|
|
|
case BT_CODEC:
|
|
|
|
|
if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND &&
|
|
|
|
|
sk->sk_state != BT_CONNECT2) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src,
|
|
|
|
|
BDADDR_BREDR);
|
|
|
|
|
if (!hdev) {
|
|
|
|
|
err = -EBADFD;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EOPNOTSUPP;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!hdev->get_data_path_id) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EOPNOTSUPP;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (optlen < sizeof(struct bt_codecs) ||
|
|
|
|
|
optlen > sizeof(buffer)) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (copy_from_sockptr(buffer, optval, optlen)) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
codecs = (void *)buffer;
|
|
|
|
|
|
|
|
|
|
if (codecs->num_codecs > 1) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sco_pi(sk)->codec = codecs->codecs[0];
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
break;
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
default:
|
|
|
|
|
err = -ENOPROTOOPT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static int sco_sock_getsockopt_old(struct socket *sock, int optname,
|
|
|
|
|
char __user *optval, int __user *optlen)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
struct sco_options opts;
|
|
|
|
|
struct sco_conninfo cinfo;
|
2007-02-09 22:24:33 +08:00
|
|
|
int len, err = 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("sk %p", sk);
|
|
|
|
|
|
|
|
|
|
if (get_user(len, optlen))
|
|
|
|
|
return -EFAULT;
|
|
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
switch (optname) {
|
|
|
|
|
case SCO_OPTIONS:
|
2013-08-08 19:53:56 +08:00
|
|
|
if (sk->sk_state != BT_CONNECTED &&
|
|
|
|
|
!(sk->sk_state == BT_CONNECT2 &&
|
|
|
|
|
test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
|
2005-04-17 06:20:36 +08:00
|
|
|
err = -ENOTCONN;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
opts.mtu = sco_pi(sk)->conn->mtu;
|
|
|
|
|
|
2021-06-03 15:41:04 +08:00
|
|
|
BT_DBG("mtu %u", opts.mtu);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
len = min_t(unsigned int, len, sizeof(opts));
|
|
|
|
|
if (copy_to_user(optval, (char *)&opts, len))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
case SCO_CONNINFO:
|
2013-08-08 19:53:56 +08:00
|
|
|
if (sk->sk_state != BT_CONNECTED &&
|
|
|
|
|
!(sk->sk_state == BT_CONNECT2 &&
|
|
|
|
|
test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
|
2005-04-17 06:20:36 +08:00
|
|
|
err = -ENOTCONN;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
2011-02-14 18:54:26 +08:00
|
|
|
memset(&cinfo, 0, sizeof(cinfo));
|
2005-04-17 06:20:36 +08:00
|
|
|
cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
|
|
|
|
|
memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
|
|
|
|
|
|
|
|
|
|
len = min_t(unsigned int, len, sizeof(cinfo));
|
|
|
|
|
if (copy_to_user(optval, (char *)&cinfo, len))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
|
|
|
|
default:
|
|
|
|
|
err = -ENOPROTOOPT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-10-26 09:08:38 +08:00
|
|
|
static int sco_sock_getsockopt(struct socket *sock, int level, int optname,
|
|
|
|
|
char __user *optval, int __user *optlen)
|
2009-01-16 04:52:14 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
int len, err = 0;
|
2013-08-19 20:23:56 +08:00
|
|
|
struct bt_voice voice;
|
2020-02-15 02:08:57 +08:00
|
|
|
u32 phys;
|
2020-06-12 03:50:41 +08:00
|
|
|
int pkt_status;
|
2021-09-07 18:12:40 +08:00
|
|
|
int buf_len;
|
|
|
|
|
struct codec_list *c;
|
|
|
|
|
u8 num_codecs, i, __user *ptr;
|
|
|
|
|
struct hci_dev *hdev;
|
|
|
|
|
struct hci_codec_caps *caps;
|
|
|
|
|
struct bt_codec codec;
|
2009-01-16 04:52:14 +08:00
|
|
|
|
|
|
|
|
BT_DBG("sk %p", sk);
|
|
|
|
|
|
|
|
|
|
if (level == SOL_SCO)
|
|
|
|
|
return sco_sock_getsockopt_old(sock, optname, optval, optlen);
|
|
|
|
|
|
|
|
|
|
if (get_user(len, optlen))
|
|
|
|
|
return -EFAULT;
|
|
|
|
|
|
|
|
|
|
lock_sock(sk);
|
|
|
|
|
|
|
|
|
|
switch (optname) {
|
2012-11-21 17:51:11 +08:00
|
|
|
|
|
|
|
|
case BT_DEFER_SETUP:
|
|
|
|
|
if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
|
|
|
|
|
err = -EINVAL;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
|
2015-10-26 09:08:38 +08:00
|
|
|
(u32 __user *)optval))
|
2012-11-21 17:51:11 +08:00
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
2013-08-19 20:23:56 +08:00
|
|
|
case BT_VOICE:
|
|
|
|
|
voice.setting = sco_pi(sk)->setting;
|
|
|
|
|
|
|
|
|
|
len = min_t(unsigned int, len, sizeof(voice));
|
|
|
|
|
if (copy_to_user(optval, (char *)&voice, len))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
2020-02-15 02:08:57 +08:00
|
|
|
case BT_PHY:
|
2020-02-19 02:33:20 +08:00
|
|
|
if (sk->sk_state != BT_CONNECTED) {
|
2020-02-15 02:08:57 +08:00
|
|
|
err = -ENOTCONN;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
phys = hci_conn_get_phy(sco_pi(sk)->conn->hcon);
|
|
|
|
|
|
|
|
|
|
if (put_user(phys, (u32 __user *) optval))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
|
2020-06-12 03:50:41 +08:00
|
|
|
case BT_PKT_STATUS:
|
|
|
|
|
pkt_status = (sco_pi(sk)->cmsg_mask & SCO_CMSG_PKT_STATUS);
|
|
|
|
|
|
|
|
|
|
if (put_user(pkt_status, (int __user *)optval))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
|
2020-09-10 14:04:02 +08:00
|
|
|
case BT_SNDMTU:
|
|
|
|
|
case BT_RCVMTU:
|
2020-11-16 21:24:21 +08:00
|
|
|
if (sk->sk_state != BT_CONNECTED) {
|
|
|
|
|
err = -ENOTCONN;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
2020-09-10 14:04:02 +08:00
|
|
|
if (put_user(sco_pi(sk)->conn->mtu, (u32 __user *)optval))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
|
2021-09-07 18:12:40 +08:00
|
|
|
case BT_CODEC:
|
|
|
|
|
num_codecs = 0;
|
|
|
|
|
buf_len = 0;
|
|
|
|
|
|
|
|
|
|
hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
|
|
|
|
|
if (!hdev) {
|
|
|
|
|
err = -EBADFD;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EOPNOTSUPP;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!hdev->get_data_path_id) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EOPNOTSUPP;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* find total buffer size required to copy codec + caps */
|
|
|
|
|
hci_dev_lock(hdev);
|
|
|
|
|
list_for_each_entry(c, &hdev->local_codecs, list) {
|
|
|
|
|
if (c->transport != HCI_TRANSPORT_SCO_ESCO)
|
|
|
|
|
continue;
|
|
|
|
|
num_codecs++;
|
|
|
|
|
for (i = 0, caps = c->caps; i < c->num_caps; i++) {
|
|
|
|
|
buf_len += 1 + caps->len;
|
|
|
|
|
caps = (void *)&caps->data[caps->len];
|
|
|
|
|
}
|
|
|
|
|
buf_len += sizeof(struct bt_codec);
|
|
|
|
|
}
|
|
|
|
|
hci_dev_unlock(hdev);
|
|
|
|
|
|
|
|
|
|
buf_len += sizeof(struct bt_codecs);
|
|
|
|
|
if (buf_len > len) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -ENOBUFS;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
ptr = optval;
|
|
|
|
|
|
|
|
|
|
if (put_user(num_codecs, ptr)) {
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
ptr += sizeof(num_codecs);
|
|
|
|
|
|
|
|
|
|
/* Iterate all the codecs supported over SCO and populate
|
|
|
|
|
* codec data
|
|
|
|
|
*/
|
|
|
|
|
hci_dev_lock(hdev);
|
|
|
|
|
list_for_each_entry(c, &hdev->local_codecs, list) {
|
|
|
|
|
if (c->transport != HCI_TRANSPORT_SCO_ESCO)
|
|
|
|
|
continue;
|
|
|
|
|
|
|
|
|
|
codec.id = c->id;
|
|
|
|
|
codec.cid = c->cid;
|
|
|
|
|
codec.vid = c->vid;
|
|
|
|
|
err = hdev->get_data_path_id(hdev, &codec.data_path);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
break;
|
|
|
|
|
codec.num_caps = c->num_caps;
|
|
|
|
|
if (copy_to_user(ptr, &codec, sizeof(codec))) {
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
ptr += sizeof(codec);
|
|
|
|
|
|
|
|
|
|
/* find codec capabilities data length */
|
|
|
|
|
len = 0;
|
|
|
|
|
for (i = 0, caps = c->caps; i < c->num_caps; i++) {
|
|
|
|
|
len += 1 + caps->len;
|
|
|
|
|
caps = (void *)&caps->data[caps->len];
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* copy codec capabilities data */
|
|
|
|
|
if (len && copy_to_user(ptr, c->caps, len)) {
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
ptr += len;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!err && put_user(buf_len, optlen))
|
|
|
|
|
err = -EFAULT;
|
|
|
|
|
|
|
|
|
|
hci_dev_unlock(hdev);
|
|
|
|
|
hci_dev_put(hdev);
|
|
|
|
|
|
|
|
|
|
break;
|
|
|
|
|
|
2009-01-16 04:52:14 +08:00
|
|
|
default:
|
|
|
|
|
err = -ENOPROTOOPT;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
static int sco_sock_shutdown(struct socket *sock, int how)
|
|
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sock %p, sk %p", sock, sk);
|
|
|
|
|
|
|
|
|
|
if (!sk)
|
|
|
|
|
return 0;
|
|
|
|
|
|
Bluetooth: Fix locking issue during fast SCO reconnection.
When SCO connection is requested and disconnected fast, there is a change
that sco_sock_shutdown is going to preempt thread started in sco_connect_cfm.
When this happens struct sock sk may be removed but a pointer to it is still
held in sco_conn_ready, where embedded spinlock is used. If it is used, but
struct sock has been removed, it will crash.
Block connection object, which will prevent struct sock from being removed
and give connection process chance to finish.
BUG: spinlock bad magic on CPU#0, kworker/u:2H/319
lock: 0xe3e99434, .magic: f3000000, .owner: (���/0, .owner_cpu: -203804160
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
Call Trace:
[<c1155659>] ? do_raw_spin_lock+0x19/0xe9
[<fb75354f>] ? sco_connect_cfm+0x92/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
*pdpt = 00000000244e1001 *pde = 0000000000000000
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid hid iwlmvm(O)e
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
EIP is at 0x0
EAX: e3e99400 EBX: e3e99400 ECX: 00000100 EDX: 00000000
ESI: e3e99434 EDI: fb763ce0 EBP: e49b9e44 ESP: e49b9e14
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 00000000 CR3: 24444000 CR4: 001007f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process kworker/u:2H (pid: 319, ti=e49b8000 task=e4ab9030 task.ti=e49b8000)
Stack:
fb75355b 00000246 fb763900 22222222 22222222 22222222 e3f94460 e3ca7c0a
e49b9e4c e3f34c00 e3ca7c0a fb763ce0 e49b9e6c fb731dbc 02000246 e4cec85c
e4cec008 00000000 e3f34c00 e4cec000 e3c2ce00 0000002c e49b9ed0 fb734ee7
Call Trace:
[<fb75355b>] ? sco_connect_cfm+0x9e/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
Code: Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e49b9e14
CR2: 0000000000000000
---[ end trace 942a6577c0abd725 ]---
Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-06 00:44:17 +08:00
|
|
|
sock_hold(sk);
|
2009-06-16 06:01:49 +08:00
|
|
|
lock_sock(sk);
|
Bluetooth: Fix locking issue during fast SCO reconnection.
When SCO connection is requested and disconnected fast, there is a change
that sco_sock_shutdown is going to preempt thread started in sco_connect_cfm.
When this happens struct sock sk may be removed but a pointer to it is still
held in sco_conn_ready, where embedded spinlock is used. If it is used, but
struct sock has been removed, it will crash.
Block connection object, which will prevent struct sock from being removed
and give connection process chance to finish.
BUG: spinlock bad magic on CPU#0, kworker/u:2H/319
lock: 0xe3e99434, .magic: f3000000, .owner: (���/0, .owner_cpu: -203804160
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
Call Trace:
[<c1155659>] ? do_raw_spin_lock+0x19/0xe9
[<fb75354f>] ? sco_connect_cfm+0x92/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
*pdpt = 00000000244e1001 *pde = 0000000000000000
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid hid iwlmvm(O)e
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
EIP is at 0x0
EAX: e3e99400 EBX: e3e99400 ECX: 00000100 EDX: 00000000
ESI: e3e99434 EDI: fb763ce0 EBP: e49b9e44 ESP: e49b9e14
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 00000000 CR3: 24444000 CR4: 001007f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process kworker/u:2H (pid: 319, ti=e49b8000 task=e4ab9030 task.ti=e49b8000)
Stack:
fb75355b 00000246 fb763900 22222222 22222222 22222222 e3f94460 e3ca7c0a
e49b9e4c e3f34c00 e3ca7c0a fb763ce0 e49b9e6c fb731dbc 02000246 e4cec85c
e4cec008 00000000 e3f34c00 e4cec000 e3c2ce00 0000002c e49b9ed0 fb734ee7
Call Trace:
[<fb75355b>] ? sco_connect_cfm+0x9e/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
Code: Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e49b9e14
CR2: 0000000000000000
---[ end trace 942a6577c0abd725 ]---
Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-06 00:44:17 +08:00
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
if (!sk->sk_shutdown) {
|
|
|
|
|
sk->sk_shutdown = SHUTDOWN_MASK;
|
|
|
|
|
sco_sock_clear_timer(sk);
|
|
|
|
|
__sco_sock_close(sk);
|
|
|
|
|
|
Bluetooth: never linger on process exit
If the current process is exiting, lingering on socket close will make
it unkillable, so we should avoid it.
Reproducer:
#include <sys/types.h>
#include <sys/socket.h>
#define BTPROTO_L2CAP 0
#define BTPROTO_SCO 2
#define BTPROTO_RFCOMM 3
int main()
{
int fd;
struct linger ling;
fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM);
//or: fd = socket(PF_BLUETOOTH, SOCK_DGRAM, BTPROTO_L2CAP);
//or: fd = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
ling.l_onoff = 1;
ling.l_linger = 1000000000;
setsockopt(fd, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling));
return 0;
}
Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2014-07-15 16:25:28 +08:00
|
|
|
if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
|
|
|
|
|
!(current->flags & PF_EXITING))
|
2009-06-16 06:01:49 +08:00
|
|
|
err = bt_sock_wait_state(sk, BT_CLOSED,
|
2012-05-17 11:36:21 +08:00
|
|
|
sk->sk_lingertime);
|
2009-06-16 06:01:49 +08:00
|
|
|
}
|
Bluetooth: Fix locking issue during fast SCO reconnection.
When SCO connection is requested and disconnected fast, there is a change
that sco_sock_shutdown is going to preempt thread started in sco_connect_cfm.
When this happens struct sock sk may be removed but a pointer to it is still
held in sco_conn_ready, where embedded spinlock is used. If it is used, but
struct sock has been removed, it will crash.
Block connection object, which will prevent struct sock from being removed
and give connection process chance to finish.
BUG: spinlock bad magic on CPU#0, kworker/u:2H/319
lock: 0xe3e99434, .magic: f3000000, .owner: (���/0, .owner_cpu: -203804160
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
Call Trace:
[<c1155659>] ? do_raw_spin_lock+0x19/0xe9
[<fb75354f>] ? sco_connect_cfm+0x92/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
*pdpt = 00000000244e1001 *pde = 0000000000000000
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid hid iwlmvm(O)e
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
EIP is at 0x0
EAX: e3e99400 EBX: e3e99400 ECX: 00000100 EDX: 00000000
ESI: e3e99434 EDI: fb763ce0 EBP: e49b9e44 ESP: e49b9e14
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 00000000 CR3: 24444000 CR4: 001007f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process kworker/u:2H (pid: 319, ti=e49b8000 task=e4ab9030 task.ti=e49b8000)
Stack:
fb75355b 00000246 fb763900 22222222 22222222 22222222 e3f94460 e3ca7c0a
e49b9e4c e3f34c00 e3ca7c0a fb763ce0 e49b9e6c fb731dbc 02000246 e4cec85c
e4cec008 00000000 e3f34c00 e4cec000 e3c2ce00 0000002c e49b9ed0 fb734ee7
Call Trace:
[<fb75355b>] ? sco_connect_cfm+0x9e/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
Code: Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e49b9e14
CR2: 0000000000000000
---[ end trace 942a6577c0abd725 ]---
Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-06 00:44:17 +08:00
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
release_sock(sk);
|
Bluetooth: Fix locking issue during fast SCO reconnection.
When SCO connection is requested and disconnected fast, there is a change
that sco_sock_shutdown is going to preempt thread started in sco_connect_cfm.
When this happens struct sock sk may be removed but a pointer to it is still
held in sco_conn_ready, where embedded spinlock is used. If it is used, but
struct sock has been removed, it will crash.
Block connection object, which will prevent struct sock from being removed
and give connection process chance to finish.
BUG: spinlock bad magic on CPU#0, kworker/u:2H/319
lock: 0xe3e99434, .magic: f3000000, .owner: (���/0, .owner_cpu: -203804160
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
Call Trace:
[<c1155659>] ? do_raw_spin_lock+0x19/0xe9
[<fb75354f>] ? sco_connect_cfm+0x92/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [< (null)>] (null)
*pdpt = 00000000244e1001 *pde = 0000000000000000
Oops: 0010 [#1] PREEMPT SMP
Modules linked in: evdev ecb rfcomm(O) libcomposite usb2380 udc_core bnep(O) btusb(O) btbcm(O) cdc_acm btintel(O) bluetooth(O) arc4 uinput hid_multitouch usbhid hid iwlmvm(O)e
Pid: 319, comm: kworker/u:2H Tainted: G O 3.8.0-115.1-plk-adaptation-byt-ivi-brd #1
EIP: 0060:[<00000000>] EFLAGS: 00010246 CPU: 0
EIP is at 0x0
EAX: e3e99400 EBX: e3e99400 ECX: 00000100 EDX: 00000000
ESI: e3e99434 EDI: fb763ce0 EBP: e49b9e44 ESP: e49b9e14
DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 8005003b CR2: 00000000 CR3: 24444000 CR4: 001007f0
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process kworker/u:2H (pid: 319, ti=e49b8000 task=e4ab9030 task.ti=e49b8000)
Stack:
fb75355b 00000246 fb763900 22222222 22222222 22222222 e3f94460 e3ca7c0a
e49b9e4c e3f34c00 e3ca7c0a fb763ce0 e49b9e6c fb731dbc 02000246 e4cec85c
e4cec008 00000000 e3f34c00 e4cec000 e3c2ce00 0000002c e49b9ed0 fb734ee7
Call Trace:
[<fb75355b>] ? sco_connect_cfm+0x9e/0x236 [bluetooth]
[<fb731dbc>] ? hci_sync_conn_complete_evt.clone.101+0x18b/0x1cb [bluetooth]
[<fb734ee7>] ? hci_event_packet+0x1acd/0x21a6 [bluetooth]
[<c1041095>] ? finish_task_switch+0x50/0x89
[<c1349a2e>] ? __schedule+0x638/0x6b8
[<fb727918>] ? hci_rx_work+0xb9/0x2b8 [bluetooth]
[<c103760a>] ? queue_delayed_work_on+0x21/0x2a
[<c1035df9>] ? process_one_work+0x157/0x21b
[<fb72785f>] ? hci_cmd_work+0xef/0xef [bluetooth]
[<c1036217>] ? worker_thread+0x16e/0x20a
[<c10360a9>] ? manage_workers+0x1cf/0x1cf
[<c103a0ef>] ? kthread+0x8d/0x92
[<c134adf7>] ? ret_from_kernel_thread+0x1b/0x28
[<c103a062>] ? __init_kthread_worker+0x24/0x24
Code: Bad EIP value.
EIP: [<00000000>] 0x0 SS:ESP 0068:e49b9e14
CR2: 0000000000000000
---[ end trace 942a6577c0abd725 ]---
Signed-off-by: Kuba Pawlak <kubax.t.pawlak@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2015-10-06 00:44:17 +08:00
|
|
|
sock_put(sk);
|
|
|
|
|
|
2009-06-16 06:01:49 +08:00
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
static int sco_sock_release(struct socket *sock)
|
|
|
|
|
{
|
|
|
|
|
struct sock *sk = sock->sk;
|
|
|
|
|
int err = 0;
|
|
|
|
|
|
|
|
|
|
BT_DBG("sock %p, sk %p", sock, sk);
|
|
|
|
|
|
|
|
|
|
if (!sk)
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
sco_sock_close(sk);
|
|
|
|
|
|
Bluetooth: never linger on process exit
If the current process is exiting, lingering on socket close will make
it unkillable, so we should avoid it.
Reproducer:
#include <sys/types.h>
#include <sys/socket.h>
#define BTPROTO_L2CAP 0
#define BTPROTO_SCO 2
#define BTPROTO_RFCOMM 3
int main()
{
int fd;
struct linger ling;
fd = socket(PF_BLUETOOTH, SOCK_STREAM, BTPROTO_RFCOMM);
//or: fd = socket(PF_BLUETOOTH, SOCK_DGRAM, BTPROTO_L2CAP);
//or: fd = socket(PF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
ling.l_onoff = 1;
ling.l_linger = 1000000000;
setsockopt(fd, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling));
return 0;
}
Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
2014-07-15 16:25:28 +08:00
|
|
|
if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
|
|
|
|
|
!(current->flags & PF_EXITING)) {
|
2005-04-17 06:20:36 +08:00
|
|
|
lock_sock(sk);
|
|
|
|
|
err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
|
|
|
|
|
release_sock(sk);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sock_orphan(sk);
|
|
|
|
|
sco_sock_kill(sk);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void sco_conn_ready(struct sco_conn *conn)
|
|
|
|
|
{
|
2010-12-01 22:58:22 +08:00
|
|
|
struct sock *parent;
|
|
|
|
|
struct sock *sk = conn->sk;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
BT_DBG("conn %p", conn);
|
|
|
|
|
|
2010-12-01 22:58:22 +08:00
|
|
|
if (sk) {
|
2021-08-10 12:14:07 +08:00
|
|
|
lock_sock(sk);
|
2021-08-10 12:14:08 +08:00
|
|
|
sco_sock_clear_timer(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
sk->sk_state = BT_CONNECTED;
|
|
|
|
|
sk->sk_state_change(sk);
|
2021-08-10 12:14:07 +08:00
|
|
|
release_sock(sk);
|
2005-04-17 06:20:36 +08:00
|
|
|
} else {
|
Bluetooth: Reduce critical section in sco_conn_ready
This patch reduces the critical section protected by sco_conn_lock in
sco_conn_ready function. The lock is acquired only when it is really
needed.
This patch fixes the following lockdep warning which is generated
when the host terminates a SCO connection.
Today, this warning is a false positive. There is no way those
two threads reported by lockdep are running at the same time since
hdev->workqueue (where rx_work is queued) is single-thread. However,
if somehow this behavior is changed in future, we will have a
potential deadlock.
======================================================
[ INFO: possible circular locking dependency detected ]
3.8.0-rc1+ #7 Not tainted
-------------------------------------------------------
kworker/u:1H/1018 is trying to acquire lock:
(&(&conn->lock)->rlock){+.+...}, at: [<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
but task is already holding lock:
(slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}:
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa003436e>] sco_connect_cfm+0xbe/0x350 [bluetooth]
[<ffffffffa0015d6c>] hci_event_packet+0xd3c/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
-> #0 (&(&conn->lock)->rlock){+.+...}:
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
*** DEADLOCK ***
4 locks held by kworker/u:1H/1018:
#0: (hdev->name#2){.+.+.+}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#1: ((&hdev->rx_work)){+.+.+.}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#2: (&hdev->lock){+.+.+.}, at: [<ffffffffa000fbe9>] hci_disconn_complete_evt.isra.54+0x59/0x3c0 [bluetooth]
#3: (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
stack backtrace:
Pid: 1018, comm: kworker/u:1H Not tainted 3.8.0-rc1+ #7
Call Trace:
[<ffffffff813e92f9>] print_circular_bug+0x1fb/0x20c
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa000fbd0>] ? hci_disconn_complete_evt.isra.54+0x40/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffff81202e90>] ? __dynamic_pr_debug+0x80/0x90
[<ffffffff8133ff7d>] ? kfree_skb+0x2d/0x40
[<ffffffffa0021644>] ? hci_send_to_monitor+0x1a4/0x1c0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104fdc1>] ? worker_thread+0x51/0x3e0
[<ffffffffa0004450>] ? hci_tx_work+0x800/0x800 [bluetooth]
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff8104fd70>] ? busy_worker_rebind_fn+0x100/0x100
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-01-30 06:59:56 +08:00
|
|
|
sco_conn_lock(conn);
|
|
|
|
|
|
2015-10-27 00:17:14 +08:00
|
|
|
if (!conn->hcon) {
|
|
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
2013-10-14 01:15:22 +08:00
|
|
|
parent = sco_get_sock_listen(&conn->hcon->src);
|
Bluetooth: Reduce critical section in sco_conn_ready
This patch reduces the critical section protected by sco_conn_lock in
sco_conn_ready function. The lock is acquired only when it is really
needed.
This patch fixes the following lockdep warning which is generated
when the host terminates a SCO connection.
Today, this warning is a false positive. There is no way those
two threads reported by lockdep are running at the same time since
hdev->workqueue (where rx_work is queued) is single-thread. However,
if somehow this behavior is changed in future, we will have a
potential deadlock.
======================================================
[ INFO: possible circular locking dependency detected ]
3.8.0-rc1+ #7 Not tainted
-------------------------------------------------------
kworker/u:1H/1018 is trying to acquire lock:
(&(&conn->lock)->rlock){+.+...}, at: [<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
but task is already holding lock:
(slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}:
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa003436e>] sco_connect_cfm+0xbe/0x350 [bluetooth]
[<ffffffffa0015d6c>] hci_event_packet+0xd3c/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
-> #0 (&(&conn->lock)->rlock){+.+...}:
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
*** DEADLOCK ***
4 locks held by kworker/u:1H/1018:
#0: (hdev->name#2){.+.+.+}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#1: ((&hdev->rx_work)){+.+.+.}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#2: (&hdev->lock){+.+.+.}, at: [<ffffffffa000fbe9>] hci_disconn_complete_evt.isra.54+0x59/0x3c0 [bluetooth]
#3: (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
stack backtrace:
Pid: 1018, comm: kworker/u:1H Not tainted 3.8.0-rc1+ #7
Call Trace:
[<ffffffff813e92f9>] print_circular_bug+0x1fb/0x20c
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa000fbd0>] ? hci_disconn_complete_evt.isra.54+0x40/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffff81202e90>] ? __dynamic_pr_debug+0x80/0x90
[<ffffffff8133ff7d>] ? kfree_skb+0x2d/0x40
[<ffffffffa0021644>] ? hci_send_to_monitor+0x1a4/0x1c0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104fdc1>] ? worker_thread+0x51/0x3e0
[<ffffffffa0004450>] ? hci_tx_work+0x800/0x800 [bluetooth]
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff8104fd70>] ? busy_worker_rebind_fn+0x100/0x100
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-01-30 06:59:56 +08:00
|
|
|
if (!parent) {
|
|
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
return;
|
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2021-08-10 12:14:07 +08:00
|
|
|
lock_sock(parent);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2010-05-02 03:15:35 +08:00
|
|
|
sk = sco_sock_alloc(sock_net(parent), NULL,
|
2015-05-09 10:09:13 +08:00
|
|
|
BTPROTO_SCO, GFP_ATOMIC, 0);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (!sk) {
|
2021-08-10 12:14:07 +08:00
|
|
|
release_sock(parent);
|
Bluetooth: Reduce critical section in sco_conn_ready
This patch reduces the critical section protected by sco_conn_lock in
sco_conn_ready function. The lock is acquired only when it is really
needed.
This patch fixes the following lockdep warning which is generated
when the host terminates a SCO connection.
Today, this warning is a false positive. There is no way those
two threads reported by lockdep are running at the same time since
hdev->workqueue (where rx_work is queued) is single-thread. However,
if somehow this behavior is changed in future, we will have a
potential deadlock.
======================================================
[ INFO: possible circular locking dependency detected ]
3.8.0-rc1+ #7 Not tainted
-------------------------------------------------------
kworker/u:1H/1018 is trying to acquire lock:
(&(&conn->lock)->rlock){+.+...}, at: [<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
but task is already holding lock:
(slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}:
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa003436e>] sco_connect_cfm+0xbe/0x350 [bluetooth]
[<ffffffffa0015d6c>] hci_event_packet+0xd3c/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
-> #0 (&(&conn->lock)->rlock){+.+...}:
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
*** DEADLOCK ***
4 locks held by kworker/u:1H/1018:
#0: (hdev->name#2){.+.+.+}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#1: ((&hdev->rx_work)){+.+.+.}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#2: (&hdev->lock){+.+.+.}, at: [<ffffffffa000fbe9>] hci_disconn_complete_evt.isra.54+0x59/0x3c0 [bluetooth]
#3: (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
stack backtrace:
Pid: 1018, comm: kworker/u:1H Not tainted 3.8.0-rc1+ #7
Call Trace:
[<ffffffff813e92f9>] print_circular_bug+0x1fb/0x20c
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa000fbd0>] ? hci_disconn_complete_evt.isra.54+0x40/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffff81202e90>] ? __dynamic_pr_debug+0x80/0x90
[<ffffffff8133ff7d>] ? kfree_skb+0x2d/0x40
[<ffffffffa0021644>] ? hci_send_to_monitor+0x1a4/0x1c0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104fdc1>] ? worker_thread+0x51/0x3e0
[<ffffffffa0004450>] ? hci_tx_work+0x800/0x800 [bluetooth]
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff8104fd70>] ? busy_worker_rebind_fn+0x100/0x100
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-01-30 06:59:56 +08:00
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
return;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
sco_sock_init(sk, parent);
|
|
|
|
|
|
2013-10-14 01:34:01 +08:00
|
|
|
bacpy(&sco_pi(sk)->src, &conn->hcon->src);
|
|
|
|
|
bacpy(&sco_pi(sk)->dst, &conn->hcon->dst);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
hci_conn_hold(conn->hcon);
|
|
|
|
|
__sco_chan_add(conn, sk, parent);
|
|
|
|
|
|
2012-11-21 17:51:12 +08:00
|
|
|
if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags))
|
|
|
|
|
sk->sk_state = BT_CONNECT2;
|
|
|
|
|
else
|
|
|
|
|
sk->sk_state = BT_CONNECTED;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
/* Wake up parent */
|
2014-04-12 04:15:36 +08:00
|
|
|
parent->sk_data_ready(parent);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2021-08-10 12:14:07 +08:00
|
|
|
release_sock(parent);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
Bluetooth: Reduce critical section in sco_conn_ready
This patch reduces the critical section protected by sco_conn_lock in
sco_conn_ready function. The lock is acquired only when it is really
needed.
This patch fixes the following lockdep warning which is generated
when the host terminates a SCO connection.
Today, this warning is a false positive. There is no way those
two threads reported by lockdep are running at the same time since
hdev->workqueue (where rx_work is queued) is single-thread. However,
if somehow this behavior is changed in future, we will have a
potential deadlock.
======================================================
[ INFO: possible circular locking dependency detected ]
3.8.0-rc1+ #7 Not tainted
-------------------------------------------------------
kworker/u:1H/1018 is trying to acquire lock:
(&(&conn->lock)->rlock){+.+...}, at: [<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
but task is already holding lock:
(slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}:
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa003436e>] sco_connect_cfm+0xbe/0x350 [bluetooth]
[<ffffffffa0015d6c>] hci_event_packet+0xd3c/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
-> #0 (&(&conn->lock)->rlock){+.+...}:
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
lock(slock-AF_BLUETOOTH-BTPROTO_SCO);
lock(&(&conn->lock)->rlock);
*** DEADLOCK ***
4 locks held by kworker/u:1H/1018:
#0: (hdev->name#2){.+.+.+}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#1: ((&hdev->rx_work)){+.+.+.}, at: [<ffffffff8104d5f8>] process_one_work+0x258/0x4f0
#2: (&hdev->lock){+.+.+.}, at: [<ffffffffa000fbe9>] hci_disconn_complete_evt.isra.54+0x59/0x3c0 [bluetooth]
#3: (slock-AF_BLUETOOTH-BTPROTO_SCO){+.+...}, at: [<ffffffffa0033d5a>] sco_conn_del+0x8a/0xe0 [bluetooth]
stack backtrace:
Pid: 1018, comm: kworker/u:1H Not tainted 3.8.0-rc1+ #7
Call Trace:
[<ffffffff813e92f9>] print_circular_bug+0x1fb/0x20c
[<ffffffff81082215>] __lock_acquire+0x1465/0x1c70
[<ffffffff81083011>] lock_acquire+0xb1/0xe0
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffff813efd01>] _raw_spin_lock+0x41/0x80
[<ffffffffa0033ba6>] ? sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033ba6>] sco_chan_del+0x66/0x190 [bluetooth]
[<ffffffffa0033d6d>] sco_conn_del+0x9d/0xe0 [bluetooth]
[<ffffffffa0034653>] sco_disconn_cfm+0x53/0x60 [bluetooth]
[<ffffffffa000fef3>] hci_disconn_complete_evt.isra.54+0x363/0x3c0 [bluetooth]
[<ffffffffa000fbd0>] ? hci_disconn_complete_evt.isra.54+0x40/0x3c0 [bluetooth]
[<ffffffffa00150f7>] hci_event_packet+0xc7/0x29b0 [bluetooth]
[<ffffffff81202e90>] ? __dynamic_pr_debug+0x80/0x90
[<ffffffff8133ff7d>] ? kfree_skb+0x2d/0x40
[<ffffffffa0021644>] ? hci_send_to_monitor+0x1a4/0x1c0 [bluetooth]
[<ffffffffa0004583>] hci_rx_work+0x133/0x870 [bluetooth]
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104d65f>] process_one_work+0x2bf/0x4f0
[<ffffffff8104d5f8>] ? process_one_work+0x258/0x4f0
[<ffffffff8104fdc1>] ? worker_thread+0x51/0x3e0
[<ffffffffa0004450>] ? hci_tx_work+0x800/0x800 [bluetooth]
[<ffffffff81050022>] worker_thread+0x2b2/0x3e0
[<ffffffff8104fd70>] ? busy_worker_rebind_fn+0x100/0x100
[<ffffffff81056021>] kthread+0xd1/0xe0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
[<ffffffff813f14bc>] ret_from_fork+0x7c/0xb0
[<ffffffff81055f50>] ? flush_kthread_worker+0xc0/0xc0
Signed-off-by: Andre Guedes <andre.guedes@openbossa.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
2013-01-30 06:59:56 +08:00
|
|
|
sco_conn_unlock(conn);
|
|
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* ----- SCO interface with lower layer (HCI) ----- */
|
2012-11-21 17:51:12 +08:00
|
|
|
int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2012-05-23 15:04:19 +08:00
|
|
|
struct sock *sk;
|
2009-01-16 04:57:02 +08:00
|
|
|
int lm = 0;
|
|
|
|
|
|
2012-09-25 17:49:43 +08:00
|
|
|
BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2009-01-16 04:57:02 +08:00
|
|
|
/* Find listening sockets */
|
|
|
|
|
read_lock(&sco_sk_list.lock);
|
hlist: drop the node parameter from iterators
I'm not sure why, but the hlist for each entry iterators were conceived
list_for_each_entry(pos, head, member)
The hlist ones were greedy and wanted an extra parameter:
hlist_for_each_entry(tpos, pos, head, member)
Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.
Besides the semantic patch, there was some manual work required:
- Fix up the actual hlist iterators in linux/list.h
- Fix up the declaration of other iterators based on the hlist ones.
- A very small amount of places were using the 'node' parameter, this
was modified to use 'obj->member' instead.
- Coccinelle didn't handle the hlist_for_each_entry_safe iterator
properly, so those had to be fixed up manually.
The semantic patch which is mostly the work of Peter Senna Tschudin is here:
@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;
type T;
expression a,c,d,e;
identifier b;
statement S;
@@
-T b;
<+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
...+>
[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-02-28 09:06:00 +08:00
|
|
|
sk_for_each(sk, &sco_sk_list.head) {
|
2009-01-16 04:57:02 +08:00
|
|
|
if (sk->sk_state != BT_LISTEN)
|
|
|
|
|
continue;
|
|
|
|
|
|
2013-10-14 01:34:01 +08:00
|
|
|
if (!bacmp(&sco_pi(sk)->src, &hdev->bdaddr) ||
|
|
|
|
|
!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
|
2009-01-16 04:57:02 +08:00
|
|
|
lm |= HCI_LM_ACCEPT;
|
2012-11-21 17:51:12 +08:00
|
|
|
|
|
|
|
|
if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
|
|
|
|
|
*flags |= HCI_PROTO_DEFER;
|
2009-01-16 04:57:02 +08:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
read_unlock(&sco_sk_list.lock);
|
|
|
|
|
|
|
|
|
|
return lm;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2015-02-18 20:53:57 +08:00
|
|
|
static void sco_connect_cfm(struct hci_conn *hcon, __u8 status)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2015-02-18 20:53:57 +08:00
|
|
|
if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
|
|
|
|
|
return;
|
|
|
|
|
|
2021-06-03 15:41:04 +08:00
|
|
|
BT_DBG("hcon %p bdaddr %pMR status %u", hcon, &hcon->dst, status);
|
2015-02-18 20:53:57 +08:00
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
if (!status) {
|
|
|
|
|
struct sco_conn *conn;
|
|
|
|
|
|
2012-04-19 22:12:28 +08:00
|
|
|
conn = sco_conn_add(hcon);
|
2005-04-17 06:20:36 +08:00
|
|
|
if (conn)
|
|
|
|
|
sco_conn_ready(conn);
|
2007-02-09 22:24:33 +08:00
|
|
|
} else
|
2011-06-30 09:18:29 +08:00
|
|
|
sco_conn_del(hcon, bt_to_errno(status));
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2015-02-18 20:53:58 +08:00
|
|
|
static void sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2015-02-18 20:53:58 +08:00
|
|
|
if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
|
|
|
|
|
return;
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
BT_DBG("hcon %p reason %d", hcon, reason);
|
|
|
|
|
|
2011-06-30 09:18:29 +08:00
|
|
|
sco_conn_del(hcon, bt_to_errno(reason));
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2015-06-09 17:47:22 +08:00
|
|
|
void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sco_conn *conn = hcon->sco_data;
|
|
|
|
|
|
|
|
|
|
if (!conn)
|
|
|
|
|
goto drop;
|
|
|
|
|
|
2021-06-03 15:41:04 +08:00
|
|
|
BT_DBG("conn %p len %u", conn, skb->len);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
if (skb->len) {
|
|
|
|
|
sco_recv_frame(conn, skb);
|
2015-06-09 17:47:22 +08:00
|
|
|
return;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
drop:
|
2007-02-09 22:24:33 +08:00
|
|
|
kfree_skb(skb);
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2015-02-18 20:53:57 +08:00
|
|
|
static struct hci_cb sco_cb = {
|
|
|
|
|
.name = "SCO",
|
|
|
|
|
.connect_cfm = sco_connect_cfm,
|
2015-02-18 20:53:58 +08:00
|
|
|
.disconn_cfm = sco_disconn_cfm,
|
2015-02-18 20:53:57 +08:00
|
|
|
};
|
|
|
|
|
|
2010-03-21 12:27:45 +08:00
|
|
|
static int sco_debugfs_show(struct seq_file *f, void *p)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
struct sock *sk;
|
|
|
|
|
|
2011-12-28 01:28:46 +08:00
|
|
|
read_lock(&sco_sk_list.lock);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
hlist: drop the node parameter from iterators
I'm not sure why, but the hlist for each entry iterators were conceived
list_for_each_entry(pos, head, member)
The hlist ones were greedy and wanted an extra parameter:
hlist_for_each_entry(tpos, pos, head, member)
Why did they need an extra pos parameter? I'm not quite sure. Not only
they don't really need it, it also prevents the iterator from looking
exactly like the list iterator, which is unfortunate.
Besides the semantic patch, there was some manual work required:
- Fix up the actual hlist iterators in linux/list.h
- Fix up the declaration of other iterators based on the hlist ones.
- A very small amount of places were using the 'node' parameter, this
was modified to use 'obj->member' instead.
- Coccinelle didn't handle the hlist_for_each_entry_safe iterator
properly, so those had to be fixed up manually.
The semantic patch which is mostly the work of Peter Senna Tschudin is here:
@@
iterator name hlist_for_each_entry, hlist_for_each_entry_continue, hlist_for_each_entry_from, hlist_for_each_entry_rcu, hlist_for_each_entry_rcu_bh, hlist_for_each_entry_continue_rcu_bh, for_each_busy_worker, ax25_uid_for_each, ax25_for_each, inet_bind_bucket_for_each, sctp_for_each_hentry, sk_for_each, sk_for_each_rcu, sk_for_each_from, sk_for_each_safe, sk_for_each_bound, hlist_for_each_entry_safe, hlist_for_each_entry_continue_rcu, nr_neigh_for_each, nr_neigh_for_each_safe, nr_node_for_each, nr_node_for_each_safe, for_each_gfn_indirect_valid_sp, for_each_gfn_sp, for_each_host;
type T;
expression a,c,d,e;
identifier b;
statement S;
@@
-T b;
<+... when != b
(
hlist_for_each_entry(a,
- b,
c, d) S
|
hlist_for_each_entry_continue(a,
- b,
c) S
|
hlist_for_each_entry_from(a,
- b,
c) S
|
hlist_for_each_entry_rcu(a,
- b,
c, d) S
|
hlist_for_each_entry_rcu_bh(a,
- b,
c, d) S
|
hlist_for_each_entry_continue_rcu_bh(a,
- b,
c) S
|
for_each_busy_worker(a, c,
- b,
d) S
|
ax25_uid_for_each(a,
- b,
c) S
|
ax25_for_each(a,
- b,
c) S
|
inet_bind_bucket_for_each(a,
- b,
c) S
|
sctp_for_each_hentry(a,
- b,
c) S
|
sk_for_each(a,
- b,
c) S
|
sk_for_each_rcu(a,
- b,
c) S
|
sk_for_each_from
-(a, b)
+(a)
S
+ sk_for_each_from(a) S
|
sk_for_each_safe(a,
- b,
c, d) S
|
sk_for_each_bound(a,
- b,
c) S
|
hlist_for_each_entry_safe(a,
- b,
c, d, e) S
|
hlist_for_each_entry_continue_rcu(a,
- b,
c) S
|
nr_neigh_for_each(a,
- b,
c) S
|
nr_neigh_for_each_safe(a,
- b,
c, d) S
|
nr_node_for_each(a,
- b,
c) S
|
nr_node_for_each_safe(a,
- b,
c, d) S
|
- for_each_gfn_sp(a, c, d, b) S
+ for_each_gfn_sp(a, c, d) S
|
- for_each_gfn_indirect_valid_sp(a, c, d, b) S
+ for_each_gfn_indirect_valid_sp(a, c, d) S
|
for_each_host(a,
- b,
c) S
|
for_each_host_safe(a,
- b,
c, d) S
|
for_each_mesh_entry(a,
- b,
c, d) S
)
...+>
[akpm@linux-foundation.org: drop bogus change from net/ipv4/raw.c]
[akpm@linux-foundation.org: drop bogus hunk from net/ipv6/raw.c]
[akpm@linux-foundation.org: checkpatch fixes]
[akpm@linux-foundation.org: fix warnings]
[akpm@linux-foudnation.org: redo intrusive kvm changes]
Tested-by: Peter Senna Tschudin <peter.senna@gmail.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2013-02-28 09:06:00 +08:00
|
|
|
sk_for_each(sk, &sco_sk_list.head) {
|
2013-10-14 01:34:01 +08:00
|
|
|
seq_printf(f, "%pMR %pMR %d\n", &sco_pi(sk)->src,
|
|
|
|
|
&sco_pi(sk)->dst, sk->sk_state);
|
2005-11-09 01:57:38 +08:00
|
|
|
}
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2011-12-28 01:28:46 +08:00
|
|
|
read_unlock(&sco_sk_list.lock);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2010-03-21 12:27:45 +08:00
|
|
|
return 0;
|
2005-04-17 06:20:36 +08:00
|
|
|
}
|
|
|
|
|
|
2018-11-05 22:56:19 +08:00
|
|
|
DEFINE_SHOW_ATTRIBUTE(sco_debugfs);
|
2010-03-21 12:27:45 +08:00
|
|
|
|
|
|
|
|
static struct dentry *sco_debugfs;
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2005-12-23 04:49:22 +08:00
|
|
|
static const struct proto_ops sco_sock_ops = {
|
2005-04-17 06:20:36 +08:00
|
|
|
.family = PF_BLUETOOTH,
|
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
|
.release = sco_sock_release,
|
|
|
|
|
.bind = sco_sock_bind,
|
|
|
|
|
.connect = sco_sock_connect,
|
|
|
|
|
.listen = sco_sock_listen,
|
|
|
|
|
.accept = sco_sock_accept,
|
|
|
|
|
.getname = sco_sock_getname,
|
|
|
|
|
.sendmsg = sco_sock_sendmsg,
|
2012-11-21 17:51:12 +08:00
|
|
|
.recvmsg = sco_sock_recvmsg,
|
2018-06-29 00:43:44 +08:00
|
|
|
.poll = bt_sock_poll,
|
2008-07-15 02:13:50 +08:00
|
|
|
.ioctl = bt_sock_ioctl,
|
2019-04-18 04:51:48 +08:00
|
|
|
.gettstamp = sock_gettstamp,
|
2005-04-17 06:20:36 +08:00
|
|
|
.mmap = sock_no_mmap,
|
|
|
|
|
.socketpair = sock_no_socketpair,
|
2009-06-16 06:01:49 +08:00
|
|
|
.shutdown = sco_sock_shutdown,
|
2005-04-17 06:20:36 +08:00
|
|
|
.setsockopt = sco_sock_setsockopt,
|
|
|
|
|
.getsockopt = sco_sock_getsockopt
|
|
|
|
|
};
|
|
|
|
|
|
2009-10-05 13:58:39 +08:00
|
|
|
static const struct net_proto_family sco_sock_family_ops = {
|
2005-04-17 06:20:36 +08:00
|
|
|
.family = PF_BLUETOOTH,
|
|
|
|
|
.owner = THIS_MODULE,
|
|
|
|
|
.create = sco_sock_create,
|
|
|
|
|
};
|
|
|
|
|
|
2011-02-08 06:08:52 +08:00
|
|
|
int __init sco_init(void)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
|
|
|
|
int err;
|
|
|
|
|
|
2015-01-12 07:21:06 +08:00
|
|
|
BUILD_BUG_ON(sizeof(struct sockaddr_sco) > sizeof(struct sockaddr));
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
err = proto_register(&sco_proto, 0);
|
|
|
|
|
if (err < 0)
|
|
|
|
|
return err;
|
|
|
|
|
|
|
|
|
|
err = bt_sock_register(BTPROTO_SCO, &sco_sock_family_ops);
|
|
|
|
|
if (err < 0) {
|
|
|
|
|
BT_ERR("SCO socket registration failed");
|
|
|
|
|
goto error;
|
|
|
|
|
}
|
|
|
|
|
|
2013-04-05 07:14:33 +08:00
|
|
|
err = bt_procfs_init(&init_net, "sco", &sco_sk_list, NULL);
|
2012-07-26 00:30:12 +08:00
|
|
|
if (err < 0) {
|
|
|
|
|
BT_ERR("Failed to create SCO proc file");
|
|
|
|
|
bt_sock_unregister(BTPROTO_SCO);
|
|
|
|
|
goto error;
|
|
|
|
|
}
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
BT_INFO("SCO socket layer initialized");
|
|
|
|
|
|
2015-02-18 20:53:57 +08:00
|
|
|
hci_register_cb(&sco_cb);
|
|
|
|
|
|
2013-10-18 08:24:16 +08:00
|
|
|
if (IS_ERR_OR_NULL(bt_debugfs))
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
sco_debugfs = debugfs_create_file("sco", 0444, bt_debugfs,
|
|
|
|
|
NULL, &sco_debugfs_fops);
|
|
|
|
|
|
2005-04-17 06:20:36 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
error:
|
|
|
|
|
proto_unregister(&sco_proto);
|
|
|
|
|
return err;
|
|
|
|
|
}
|
|
|
|
|
|
2015-03-08 03:52:28 +08:00
|
|
|
void sco_exit(void)
|
2005-04-17 06:20:36 +08:00
|
|
|
{
|
2012-07-26 00:30:12 +08:00
|
|
|
bt_procfs_cleanup(&init_net, "sco");
|
|
|
|
|
|
2010-03-21 12:27:45 +08:00
|
|
|
debugfs_remove(sco_debugfs);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
2015-02-18 20:53:57 +08:00
|
|
|
hci_unregister_cb(&sco_cb);
|
|
|
|
|
|
2013-02-25 02:36:51 +08:00
|
|
|
bt_sock_unregister(BTPROTO_SCO);
|
2005-04-17 06:20:36 +08:00
|
|
|
|
|
|
|
|
proto_unregister(&sco_proto);
|
|
|
|
|
}
|
|
|
|
|
|
2008-07-15 02:13:53 +08:00
|
|
|
module_param(disable_esco, bool, 0644);
|
|
|
|
|
MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
|
