[PATCH] Bluetooth: hci_core: fix list_for_each_entry_rcu usage

[PATCH] Bluetooth: hci_core: fix list_for_each_entry_rcu usage

[Pauli Virtanen]

Releasing + re-acquiring RCU lock inside list_for_each_entry_rcu() loop
body is not correct.

Fix by taking the update-side hdev->lock instead.

Fixes: c7eaf80bfb0c ("Bluetooth: Fix hci_link_tx_to RCU lock usage")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---
 net/bluetooth/hci_core.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 3b49828160b7..04845ff3ad57 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3417,23 +3417,18 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
 
 	bt_dev_err(hdev, "link tx timeout");
 
-	rcu_read_lock();
+	hci_dev_lock(hdev);
 
 	/* Kill stalled connections */
-	list_for_each_entry_rcu(c, &h->list, list) {
+	list_for_each_entry(c, &h->list, list) {
 		if (c->type == type && c->sent) {
 			bt_dev_err(hdev, "killing stalled connection %pMR",
 				   &c->dst);
-			/* hci_disconnect might sleep, so, we have to release
-			 * the RCU read lock before calling it.
-			 */
-			rcu_read_unlock();
 			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
-			rcu_read_lock();
 		}
 	}
 
-	rcu_read_unlock();
+	hci_dev_unlock(hdev);
 }
 
 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
-- 
2.49.0

RE: Bluetooth: hci_core: fix list_for_each_entry_rcu usage

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2029 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=967792

---Test result---

Test Summary:
CheckPatch                    PENDING   0.30 seconds
GitLint                       PENDING   0.28 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      23.89 seconds
CheckAllWarning               PASS      25.97 seconds
CheckSparse                   PASS      29.37 seconds
BuildKernel32                 PASS      23.39 seconds
TestRunnerSetup               PASS      447.61 seconds
TestRunner_l2cap-tester       PASS      26.72 seconds
TestRunner_iso-tester         PASS      41.31 seconds
TestRunner_bnep-tester        PASS      5.78 seconds
TestRunner_mgmt-tester        FAIL      128.21 seconds
TestRunner_rfcomm-tester      PASS      9.13 seconds
TestRunner_sco-tester         PASS      14.49 seconds
TestRunner_ioctl-tester       PASS      9.73 seconds
TestRunner_mesh-tester        PASS      7.14 seconds
TestRunner_smp-tester         PASS      8.34 seconds
TestRunner_userchan-tester    PASS      6.04 seconds
IncrementalBuild              PENDING   0.48 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 484 (98.8%), Failed: 2, Not Run: 4

Failed Test Cases
LL Privacy - Add Device 3 (AL is full)               Failed       0.216 seconds
LL Privacy - Set Flags 1 (Add to RL)                 Failed       0.156 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: hci_core: fix list_for_each_entry_rcu usage

[Paul Menzel]

Dear Pauli,


Thank you for your patch.

Am 31.05.25 um 17:24 schrieb Pauli Virtanen:
> Releasing + re-acquiring RCU lock inside list_for_each_entry_rcu() loop
> body is not correct.
> 
> Fix by taking the update-side hdev->lock instead.
> 
> Fixes: c7eaf80bfb0c ("Bluetooth: Fix hci_link_tx_to RCU lock usage")
> Signed-off-by: Pauli Virtanen <pav@iki.fi>
> ---
>   net/bluetooth/hci_core.c | 11 +++--------
>   1 file changed, 3 insertions(+), 8 deletions(-)
> 
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index 3b49828160b7..04845ff3ad57 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3417,23 +3417,18 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
>   
>   	bt_dev_err(hdev, "link tx timeout");
>   
> -	rcu_read_lock();
> +	hci_dev_lock(hdev);
>   
>   	/* Kill stalled connections */
> -	list_for_each_entry_rcu(c, &h->list, list) {
> +	list_for_each_entry(c, &h->list, list) {
>   		if (c->type == type && c->sent) {
>   			bt_dev_err(hdev, "killing stalled connection %pMR",
>   				   &c->dst);
> -			/* hci_disconnect might sleep, so, we have to release
> -			 * the RCU read lock before calling it.
> -			 */
> -			rcu_read_unlock();
>   			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
> -			rcu_read_lock();
>   		}
>   	}
>   
> -	rcu_read_unlock();
> +	hci_dev_unlock(hdev);
>   }
>   
>   static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul

Re: [PATCH] Bluetooth: hci_core: fix list_for_each_entry_rcu usage

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Sat, 31 May 2025 18:24:58 +0300 you wrote:
> Releasing + re-acquiring RCU lock inside list_for_each_entry_rcu() loop
> body is not correct.
> 
> Fix by taking the update-side hdev->lock instead.
> 
> Fixes: c7eaf80bfb0c ("Bluetooth: Fix hci_link_tx_to RCU lock usage")
> Signed-off-by: Pauli Virtanen <pav@iki.fi>
> 
> [...]

Here is the summary with links:
  - Bluetooth: hci_core: fix list_for_each_entry_rcu usage
    https://git.kernel.org/bluetooth/bluetooth-next/c/6c5d0010e8a4

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html