Hi Ying, On Wed, May 24, 2023 at 3:54 AM Ying Hsu <yinghsu@xxxxxxxxxxxx> wrote: > > Hi Simon, > > I understand your concern about the repeated code. > However, simply hiding the locking logic in another function > introduces hidden assumptions. > For this patch, I would like to fix the deadlock in a simple and easy > to understand way. > We can always refactor the l2cap_chan utility functions later. > > Hi Luis, > > I'll add a fixes tag in the next version. And how about doing this: https://gist.github.com/Vudentz/e513859ecb31e79c947dfcb4b5c60453 > Best regards, > Ying > > > On Wed, May 24, 2023 at 3:06 AM Luiz Augusto von Dentz > <luiz.dentz@xxxxxxxxx> wrote: > > > > Hi Simon, Ying, > > > > On Tue, May 23, 2023 at 3:04 AM Simon Horman <simon.horman@xxxxxxxxxxxx> wrote: > > > > > > On Mon, May 22, 2023 at 11:41:51PM +0000, Ying Hsu wrote: > > > > L2CAP assumes that the locks conn->chan_lock and chan->lock are > > > > acquired in the order conn->chan_lock, chan->lock to avoid > > > > potential deadlock. > > > > For example, l2sock_shutdown acquires these locks in the order: > > > > mutex_lock(&conn->chan_lock) > > > > l2cap_chan_lock(chan) > > > > > > > > However, l2cap_disconnect_req acquires chan->lock in > > > > l2cap_get_chan_by_scid first and then acquires conn->chan_lock > > > > before calling l2cap_chan_del. This means that these locks are > > > > acquired in unexpected order, which leads to potential deadlock: > > > > l2cap_chan_lock(c) > > > > mutex_lock(&conn->chan_lock) > > > > > > > > This patch uses __l2cap_get_chan_by_scid to replace > > > > l2cap_get_chan_by_scid and adjusts the locking order to avoid the > > > > potential deadlock. > > > > This needs the fixes tag so we can backport it properly. > > > > > > Signed-off-by: Ying Hsu <yinghsu@xxxxxxxxxxxx> > > > > --- > > > > This commit has been tested on a Chromebook device. > > > > > > > > Changes in v2: > > > > - Adding the prefix "Bluetooth:" to subject line. > > > > > > > > net/bluetooth/l2cap_core.c | 26 ++++++++++++++++++++------ > > > > 1 file changed, 20 insertions(+), 6 deletions(-) > > > > > > > > diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c > > > > index 376b523c7b26..8f08192b8fb1 100644 > > > > --- a/net/bluetooth/l2cap_core.c > > > > +++ b/net/bluetooth/l2cap_core.c > > > > @@ -4651,8 +4651,16 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, > > > > > > > > BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); > > > > > > > > - chan = l2cap_get_chan_by_scid(conn, dcid); > > > > + mutex_lock(&conn->chan_lock); > > > > + chan = __l2cap_get_chan_by_scid(conn, dcid); > > > > + if (chan) { > > > > + chan = l2cap_chan_hold_unless_zero(chan); > > > > + if (chan) > > > > + l2cap_chan_lock(chan); > > > > + } > > > > + > > > > if (!chan) { > > > > + mutex_unlock(&conn->chan_lock); > > > > cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); > > > > return 0; > > > > } > > > > > > Hi Ying, > > > > > > The conditional setting of chan and calling l2cap_chan_lock() > > > is both non-trivial and repeated. It seems that it ought to be > > > in a helper. > > > > > > Something like this (I'm sure a better function name can be chosen): > > > > > > chan = __l2cap_get_and_lock_chan_by_scid(conn, dcid); > > > if (!chan) { > > > ... > > > } > > > > > > ... > > > > Or perhaps we could do something like l2cap_del_chan_by_scid: > > > > https://gist.github.com/Vudentz/e513859ecb31e79c947dfcb4b5c60453 > > > > -- > > Luiz Augusto von Dentz -- Luiz Augusto von Dentz
