From b40df5743ee8aed8674edbbb77b8fd3c8c7a747f Mon Sep 17 00:00:00 2001 From: Jiri Kosina Date: Wed, 7 Mar 2007 20:41:18 -0800 Subject: [PATCH] [PATCH] bluetooth: fix socket locking in hci_sock_dev_event() [Bluetooth] Fix socket locking in hci_sock_dev_event() hci_sock_dev_event() uses bh_lock_sock() to lock the socket lock. This is not deadlock-safe against locking of the same socket lock in l2cap_connect_cfm() from softirq context. In addition to that, hci_sock_dev_event() doesn't seem to be called from softirq context, so it is safe to use lock_sock()/release_sock() instead. The lockdep warning can be triggered on my T42p simply by switching the Bluetooth off by the keyboard button. ================================= [ INFO: inconsistent lock state ] 2.6.21-rc2 #4 --------------------------------- inconsistent {in-softirq-W} -> {softirq-on-W} usage. khubd/156 [HC0[0]:SC0[0]:HE1:SE1] takes: (slock-AF_BLUETOOTH){-+..}, at: [] hci_sock_dev_event+0xa8/0xc5 [bluetooth] {in-softirq-W} state was registered at: [] mark_lock+0x59/0x414 [] l2cap_connect_cfm+0x4e/0x11f [l2cap] [] __lock_acquire+0x3e5/0xb99 [] l2cap_connect_cfm+0x4e/0x11f [l2cap] [] lock_acquire+0x67/0x81 [] l2cap_connect_cfm+0x4e/0x11f [l2cap] [] _spin_lock+0x29/0x34 [] l2cap_connect_cfm+0x4e/0x11f [l2cap] [] l2cap_connect_cfm+0x4e/0x11f [l2cap] [] hci_send_cmd+0x126/0x14f [bluetooth] [] hci_event_packet+0x729/0xebd [bluetooth] [] hci_rx_task+0x2a/0x20f [bluetooth] [] hci_rx_task+0x6c/0x20f [bluetooth] [] trace_hardirqs_on+0x10d/0x14e [] tasklet_action+0x3d/0x68 [] __do_softirq+0x41/0x92 [] do_softirq+0x27/0x3d [] do_IRQ+0x7b/0x8f [] common_interrupt+0x24/0x34 [] common_interrupt+0x2e/0x34 [] acpi_processor_idle+0x1b3/0x34a [] acpi_processor_idle+0x1b6/0x34a [] cpu_idle+0x39/0x4e [] start_kernel+0x372/0x37a [] unknown_bootoption+0x0/0x202 [] 0xffffffff Signed-off-by: Jiri Kosina Acked-by: Marcel Holtmann Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- net/bluetooth/hci_sock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c index f928d2b2a17d..71f5cfbbebb8 100644 --- a/net/bluetooth/hci_sock.c +++ b/net/bluetooth/hci_sock.c @@ -656,7 +656,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, /* Detach sockets from device */ read_lock(&hci_sk_list.lock); sk_for_each(sk, node, &hci_sk_list.head) { - bh_lock_sock(sk); + lock_sock(sk); if (hci_pi(sk)->hdev == hdev) { hci_pi(sk)->hdev = NULL; sk->sk_err = EPIPE; @@ -665,7 +665,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, hci_dev_put(hdev); } - bh_unlock_sock(sk); + release_sock(sk); } read_unlock(&hci_sk_list.lock); } -- 2.34.1