linux-kernel - Re: [Regression] Bluetooth RFComm: using it locks up the machine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 04 Mar 2007 12:55:32 -0500
From:	Mark Lord <lkml@....ca>
To:	unlisted-recipients:; (no To-header on input)
Cc:	Linux Kernel <linux-kernel@...r.kernel.org>,
	bluez-devel@...ts.sf.net, marcel@...tmann.org,
	Andrew Morton <akpm@...l.org>,
	"David S. Miller" <davem@...set.davemloft.net>,
	Greg KH <gregkh@...e.de>
Subject: Re: [Regression] Bluetooth RFComm:  using it locks up the machine

Mark Lord wrote:
> Mark Lord wrote:
>> Any attempt to open/use a bluetooth rfcomm device locks up
>> scheduling completely on my machine.
>>
>> Interrupts (ping, alt-sysrq) seem to be alive, but nothing else.
>>
>> This was working fine in 2.6.20, broken now in 2.6.21-rc2-git*
> 
> Further info:  Reverting this change (below) fixes it:
> 
> | author    Marcel Holtmann <marcel@...tmann.org>
> |      Sat, 17 Feb 2007 22:58:57 +0000 (23:58 +0100)
> | committer    David S. Miller <davem@...set.davemloft.net>
> |      Mon, 26 Feb 2007 19:42:41 +0000 (11:42 -0800)
> | commit    c1a3313698895d8ad4760f98642007bf236af2e8
> | tree    337a876f727061362b6a169f8759849c105b8f7a    tree | snapshot
> | parent    f5ffd4620aba9e55656483ae1ef5c79ba81f5403    commit | diff
> | | [Bluetooth] Make use of device_move() for RFCOMM TTY devices
> | | In the case of bound RFCOMM TTY devices the parent is not available
> | before its usage. So when opening a RFCOMM TTY device, move it to
> | the corresponding ACL device as a child. When closing the device,
> | move it back to the virtual device tree.
> | Signed-off-by: Marcel Holtmann <marcel@...tmann.org>
..

The lockup is happening inside the call to device_move(),
specifically in sysfs_move_dir() it loops here forever:

...
again:
        mutex_lock(&old_parent_dentry->d_inode->i_mutex);
        if (!mutex_trylock(&new_parent_dentry->d_inode->i_mutex)) {
                mutex_unlock(&old_parent_dentry->d_inode->i_mutex);
                goto again;
        }
...

Screen-shot (photograph) from alt-sysrq-P is here:
    http://rtr.ca/recent/rfcomm_pc.jpg

Cheers

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/