linux-kernel - bluetooth: fix deadlock on device reset and power down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 31 Mar 2012 15:23:38 +0200
From:	Alexander Holler <holler@...oftware.de>
To:	linux-bluetooth@...r.kernel.org
CC:	linux-kernel@...r.kernel.org
Subject: bluetooth: fix deadlock on device reset and power down

Hello,

I've experienced a deadlock on shutdown using kernel 3.3 and tracked it 
down. Because I'm not very familiar with the bluetooth stack I'm not 
sure if the below patch is correct, but it fixed the problem here.

This patch should go to the stable tree too, if approved.

Regards,

Alexander

--------------
 From 9d0902dc07504ab28a31de471cfb3225fb0404c6 Mon Sep 17 00:00:00 2001
From: Alexander Holler <holler@...oftware.de>
Date: Sat, 31 Mar 2012 15:03:27 +0200
Subject: [PATCH] bluetooth: fix deadlock on device reset and power down

Commit 09fd0de5bd8f8ef3317e5365f92f1a13dcd89aa9 introduced a deadlock:

bluetoothd calls ioctl HCIDEVDOWN
     hci_sock_ioctl()
         hci_dev_close()
             hci_dev_do_close()
                 hci_dev_lock(hdev);
                 inquiry_cache_flush();
                 hci_conn_hash_flush();
                     hci_conn_del()
                         cancel_delayed_work_sync()
                             hci_conn_timeout()
                                 hci_dev_lock(hdev); /* DEADLOCK */
                 hci_dev_unlock(hdev);

Signed-off-by: Alexander Holler <holler@...oftware.de>
---
  net/bluetooth/hci_core.c |    4 ++--
  1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 5aeb624..3428036 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -629,8 +629,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)

  	hci_dev_lock(hdev);
  	inquiry_cache_flush(hdev);
-	hci_conn_hash_flush(hdev);
  	hci_dev_unlock(hdev);
+	hci_conn_hash_flush(hdev);

  	hci_notify(hdev, HCI_DEV_DOWN);

@@ -713,8 +713,8 @@ int hci_dev_reset(__u16 dev)

  	hci_dev_lock(hdev);
  	inquiry_cache_flush(hdev);
-	hci_conn_hash_flush(hdev);
  	hci_dev_unlock(hdev);
+	hci_conn_hash_flush(hdev);

  	if (hdev->flush)
  		hdev->flush(hdev);
-- 
1.7.6.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/