Kernel warning during unpairing while bnep connection is active

Kernel warning during unpairing while bnep connection is active

[Christian Eggers]

Target: 
- linux-5.15.49-rt47
- ARMv7l (i.MX6ULL)
- Yocto/OpenEmbedded Kirkstone
- bluez-5.64

Peer: Sony Xperia 10 III (phone with Bluetooth Tethering enabled)

Setup: Target+Peer are in paired state. A bnep connection from the
target system to the phone has been established (via NetworkManager).

When I try to remove/unpair the target on the phone side (without
disconnecting before). I get a kernel warning (about 50% reproducible):

[   24.922884] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   24.922932] Bluetooth: BNEP socket layer initialized
[   46.225493] ------------[ cut here ]------------
[   46.225512] WARNING: CPU: 0 PID: 466 at fs/sysfs/group.c:279 sysfs_remove_group+0x2d/0x5c
[   46.225551] sysfs group 'byte_queue_limits' not found for kobject 'tx-0'
[   46.225558] Modules linked in: cmac bnep usb_f_mass_storage usb_f_ncm u_ether libcomposite configfs ebt_ip ebtable_broute ebtables x_tables btusb btbcm btintel bluetooth sd_mod jitterentropy_rng drbg ksz9477_i2c ksz9477 tag_ksz ksz_common dsa_core st_magn_spi phylink st_sensors_spi regmap_spi bridge st_magn_i2c st_sensors_i2c stp st_magn rtc_rv3028 ecdh_generic llc as73211 ecc st_sensors industrialio_triggered_buffer at24 kfifo_buf regmap_i2c i2c_dev imx_thermal spidev imx_fan usb_storage leds_pwm leds_gpio led_class scsi_mod scsi_common iio_trig_sysfs imx6sx_adc industrialio micrel fec ptp pps_core imx_napi at25 spi_imx i2c_imx imx_sdma virt_dma
[   46.225809] CPU: 0 PID: 466 Comm: kbnepd bnep0 Not tainted 5.15.49-rt47 #1
[   46.225823] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
[   46.225838] [<c0107bc1>] (unwind_backtrace) from [<c01069ff>] (show_stack+0xb/0xc)
[   46.225868] [<c01069ff>] (show_stack) from [<c03a7589>] (dump_stack_lvl+0x19/0x1e)
[   46.225897] [<c03a7589>] (dump_stack_lvl) from [<c0114b89>] (__warn+0x79/0xa0)
[   46.225924] [<c0114b89>] (__warn) from [<c03a5485>] (warn_slowpath_fmt+0x31/0x54)
[   46.225949] [<c03a5485>] (warn_slowpath_fmt) from [<c0208c11>] (sysfs_remove_group+0x2d/0x5c)
[   46.225979] [<c0208c11>] (sysfs_remove_group) from [<c03445ef>] (netdev_queue_update_kobjects+0xa3/0xc8)
[   46.226006] [<c03445ef>] (netdev_queue_update_kobjects) from [<c034464f>] (netdev_unregister_kobject+0x3b/0x5c)
[   46.226028] [<c034464f>] (netdev_unregister_kobject) from [<c032be99>] (unregister_netdevice_many+0x329/0x378)
[   46.226056] [<c032be99>] (unregister_netdevice_many) from [<c032bf3f>] (unregister_netdevice_queue+0x57/0x64)
[   46.226083] [<c032bf3f>] (unregister_netdevice_queue) from [<c032bf5d>] (unregister_netdev+0x11/0x18)
[   46.226108] [<c032bf5d>] (unregister_netdev) from [<bfa0b54b>] (bnep_session+0x3d9/0x432 [bnep])
[   46.226180] [<bfa0b54b>] (bnep_session [bnep]) from [<c0126029>] (kthread+0xcd/0xdc)
[   46.226217] [<c0126029>] (kthread) from [<c0100119>] (ret_from_fork+0x11/0x38)
[   46.226238] Exception stack(0xc5259fb0 to 0xc5259ff8)
[   46.226251] 9fa0:                                     00000000 00000000 00000000 00000000
[   46.226263] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   46.226274] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   46.226782] ---[ end trace 0000000000000002 ]---
[   46.705223] ------------[ cut here ]------------
[   46.705237] WARNING: CPU: 0 PID: 466 at fs/sysfs/group.c:279 sysfs_remove_group+0x2d/0x5c
[   46.705273] sysfs group 'statistics' not found for kobject 'bnep0'
[   46.705280] Modules linked in: cmac bnep usb_f_mass_storage usb_f_ncm u_ether libcomposite configfs ebt_ip ebtable_broute ebtables x_tables btusb btbcm btintel bluetooth sd_mod jitterentropy_rng drbg ksz9477_i2c ksz9477 tag_ksz ksz_common dsa_core st_magn_spi phylink st_sensors_spi regmap_spi bridge st_magn_i2c st_sensors_i2c stp st_magn rtc_rv3028 ecdh_generic llc as73211 ecc st_sensors industrialio_triggered_buffer at24 kfifo_buf regmap_i2c i2c_dev imx_thermal spidev imx_fan usb_storage leds_pwm leds_gpio led_class scsi_mod scsi_common iio_trig_sysfs imx6sx_adc industrialio micrel fec ptp pps_core imx_napi at25 spi_imx i2c_imx imx_sdma virt_dma
[   46.705529] CPU: 0 PID: 466 Comm: kbnepd bnep0 Tainted: G        W         5.15.49-rt47 #1
[   46.705546] Hardware name: Freescale i.MX6 Ultralite (Device Tree)
[   46.705560] [<c0107bc1>] (unwind_backtrace) from [<c01069ff>] (show_stack+0xb/0xc)
[   46.705590] [<c01069ff>] (show_stack) from [<c03a7589>] (dump_stack_lvl+0x19/0x1e)
[   46.705617] [<c03a7589>] (dump_stack_lvl) from [<c0114b89>] (__warn+0x79/0xa0)
[   46.705644] [<c0114b89>] (__warn) from [<c03a5485>] (warn_slowpath_fmt+0x31/0x54)
[   46.705669] [<c03a5485>] (warn_slowpath_fmt) from [<c0208c11>] (sysfs_remove_group+0x2d/0x5c)
[   46.705699] [<c0208c11>] (sysfs_remove_group) from [<c0208e65>] (sysfs_remove_groups+0x17/0x18)
[   46.705724] [<c0208e65>] (sysfs_remove_groups) from [<c02aa02d>] (device_remove_attrs+0x2b/0x52)
[   46.705754] [<c02aa02d>] (device_remove_attrs) from [<c02ab29d>] (device_del+0xf5/0x214)
[   46.705780] [<c02ab29d>] (device_del) from [<c032be99>] (unregister_netdevice_many+0x329/0x378)
[   46.705807] [<c032be99>] (unregister_netdevice_many) from [<c032bf3f>] (unregister_netdevice_queue+0x57/0x64)
[   46.705834] [<c032bf3f>] (unregister_netdevice_queue) from [<c032bf5d>] (unregister_netdev+0x11/0x18)
[   46.705860] [<c032bf5d>] (unregister_netdev) from [<bfa0b54b>] (bnep_session+0x3d9/0x432 [bnep])
[   46.705905] [<bfa0b54b>] (bnep_session [bnep]) from [<c0126029>] (kthread+0xcd/0xdc)
[   46.705939] [<c0126029>] (kthread) from [<c0100119>] (ret_from_fork+0x11/0x38)
[   46.705962] Exception stack(0xc5259fb0 to 0xc5259ff8)
[   46.705977] 9fa0:                                     00000000 00000000 00000000 00000000
[   46.705989] 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[   46.706000] 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[   46.706007] ---[ end trace 0000000000000003 ]---


I don't get this kernel warning if I disconnect first (from the phone) before unpairing.

It looks like the device is simultaneously removed from "the other end"
at the same time when unregister_netdev() is active:

worker_thread()
+-process_one_work()
  +-hci_rx_work()
    +-hci_event_packet()
      +-hci_disconn_complete_evt()
        +-hci_conn_del()
          +-hci_conn_cleanup()
            +-hci_conn_del_sysfs()
              +-device_del()


regards
Christian