[PATCH] Bluetooth: L2CAP: avoid deadlock with process_pending_rx

[PATCH] Bluetooth: L2CAP: avoid deadlock with process_pending_rx

[Oliver Neukum]

The fix for the deadlock caused by cancelling works taking a lock
while holding the same lock in l2cap_conn_del()
shifted the cancellation of info_timer and id_addr_timer to a time
before taking the lock. However, it left cancelling
pending_rx_work() inside the scope of the lock. process_pending_rx(),
however, also takes the lock. It can deadlock.
Shift the cancellation to before the lock, too.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: ab4eedb790cae ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
---
 net/bluetooth/l2cap_core.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 62133eef9d2f..4b144eefdd33 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1772,8 +1772,14 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 
+	/*
+	 * these take conn->lock
+	 * Hence a synchronous cancellation
+	 * would deadlock if done with the lock held
+	 */
 	disable_delayed_work_sync(&conn->info_timer);
 	disable_delayed_work_sync(&conn->id_addr_timer);
+	disable_work_sync(&conn->pending_rx_work);
 
 	mutex_lock(&conn->lock);
 
@@ -1781,13 +1787,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 	skb_queue_purge(&conn->pending_rx);
 
-	/* We can not call flush_work(&conn->pending_rx_work) here since we
-	 * might block if we are running on a worker from the same workqueue
-	 * pending_rx_work is waiting on.
-	 */
-	if (work_pending(&conn->pending_rx_work))
-		cancel_work_sync(&conn->pending_rx_work);
-
 	ida_destroy(&conn->tx_ida);
 
 	l2cap_unregister_all_users(conn);
-- 
2.54.0

RE: Bluetooth: L2CAP: avoid deadlock with process_pending_rx

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 555 bytes --]

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: patch failed: net/bluetooth/l2cap_core.c:1772
error: net/bluetooth/l2cap_core.c: patch does not apply
hint: Use 'git am --show-current-patch' to see the failed patch

Please resolve the issue and submit the patches again.


---
Regards,
Linux Bluetooth