* [PATCH] Bluetooth: 6LoWPAN: Use RCU-safe device list removal
@ 2026-10-06 7:35 Cen Zhang
2026-10-06 8:31 ` bluez.test.bot
2026-10-07 17:30 ` [PATCH] " patchwork-bot+bluetooth
0 siblings, 2 replies; 3+ messages in thread
From: Cen Zhang @ 2026-10-06 7:35 UTC (permalink / raw)
To: marcel, luiz.dentz
Cc: linux-bluetooth, linux-kernel, baijiaju1990, jjzuming, zzzccc427
RCU readers of bt_6lowpan_devices must be able to follow an adapter's
forward link until their read-side critical section ends. The entries
are published with list_add_rcu(), but device_event() removes an entry
on NETDEV_UNREGISTER with list_del(), poisoning that link.
When an adapter is being unregistered and 6LoWPAN is enabled, a
6lowpan_control debugfs write with an existing LE L2CAP connection can
enter lookup_peer() after unregister's first synchronize_net(). If the
connection has no peer on that adapter, the reader must advance to the
next list entry. Neither RTNL nor devices_lock excludes this RCU reader.
The last peer's chan_close_cb() schedules delete_netdev(), which reaches
unregister_netdevice_many_notify() through unregister_dev() and
lowpan_unregister_netdev(). The following ordering is possible:
Unregister worker Control writer
----------------- --------------
synchronize_net() returns
lowpan_control_write()
lookup_peer(): rcu_read_lock()
reach adapter; no matching peer
device_event(): devices_lock
list_del(&entry->list)
spin_unlock(&devices_lock)
follow poisoned next link
read invalid adapter address
post-notifier synchronize_net()
waits for the reader
This invalid pointer access can fault in lookup_peer(). The first grace
period drains existing readers but permits new ones to start, and the
later grace period cannot prevent the intervening poisoned-link access.
Use list_del_rcu() under the existing devices_lock to preserve the
forward link for readers that already reached the adapter. The existing
post-notifier synchronize_net() waits for those readers before netdevice
teardown frees the private storage containing lowpan_btle_dev.
KASAN report as below:
[...]
[ 45.867526] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000023: 0000 [#1] SMP KASAN NOPTI
[ 45.869489] KASAN: maybe wild-memory-access in range [0xdead000000000118-0xdead00000000011f]
[ 45.870981] CPU: 1 UID: 0 PID: 646 Comm: sh Not tainted 7.2.0-rc6-pmb-bt-functional-v1+ #4 PREEMPT(lazy)
[ 45.872609] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 45.874380] RIP: 0010:lookup_peer+0x1ba/0x320
[ 45.875067] Code: 48 89 d9 ba 04 00 00 00 4c 89 fe bf a0 06 00 00 e8 2b e8 ad fb e9 56 ff ff ff e8 01 1e c3 fb 49 8d 7f 18 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 4a 01 00 00 4d 8b 47 18 4c 89 f1 ba 04 00 00 00
[ 45.878206] RSP: 0018:ffff888114d67b90 EFLAGS: 00010212
[ 45.879106] RAX: 1bd5a00000000023 RBX: 0000000000000000 RCX: ffffffff85c1d19f
[ 45.880334] RDX: ffff88810dc35700 RSI: 0000000000000000 RDI: dead000000000118
[ 45.881455] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001
[ 45.882546] R10: ffffffff893d3057 R11: ffff88810dc35700 R12: ffff88810a690000
[ 45.883839] R13: ffff888115451038 R14: ffff88810a690000 R15: dead000000000100
[ 45.885186] FS: 00007fa889bac780(0000) GS:ffff8881fd852000(0000) knlGS:0000000000000000
[ 45.886539] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 45.887527] CR2: 00007ffe304f2f80 CR3: 0000000104f64005 CR4: 0000000000770ef0
[ 45.888687] PKRU: 55555554
[ 45.889183] Call Trace:
[ 45.889666] <TASK>
[ 45.890061] lowpan_control_write+0x445/0x9e0
[ 45.890854] ? __pfx_lowpan_control_write+0x10/0x10
[ 45.891738] ? srso_alias_return_thunk+0x5/0xfbef5
[ 45.892603] ? srso_alias_return_thunk+0x5/0xfbef5
[ 45.893383] ? __debugfs_file_get+0x1bd/0x7f0
[ 45.894057] ? srso_alias_return_thunk+0x5/0xfbef5
[ 45.894902] ? lock_acquire+0x17b/0x2f0
[ 45.895593] ? ksys_write+0x111/0x200
[ 45.896290] full_proxy_write+0x11f/0x180
[ 45.896991] vfs_write+0x25a/0x1010
[ 45.897642] ? __pfx_full_proxy_write+0x10/0x10
[ 45.898440] ? __pfx_vfs_write+0x10/0x10
[ 45.899178] ? lock_release+0x11f/0x280
[ 45.899855] ksys_write+0x111/0x200
[ 45.900435] ? __pfx_ksys_write+0x10/0x10
[ 45.901074] ? irqentry_exit+0xbe/0x820
[ 45.901722] ? srso_alias_return_thunk+0x5/0xfbef5
[ 45.902489] do_syscall_64+0x115/0x6a0
[ 45.903064] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 45.903813] RIP: 0033:0x7fa889c3e687
[ 45.904359] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
[ 45.906981] RSP: 002b:00007ffd7651b960 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
[ 45.908070] RAX: ffffffffffffffda RBX: 00007fa889bac780 RCX: 00007fa889c3e687
[ 45.909102] RDX: 000000000000001c RSI: 00005570f25e8d10 RDI: 0000000000000001
[ 45.910133] RBP: 00005570f25e8d10 R08: 0000000000000000 R09: 0000000000000000
[ 45.911162] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001
[ 45.912190] R13: 000000000000001c R14: 0000000000000000 R15: 00005570f25e8a78
[ 45.913208] </TASK>
[ 45.913530] Modules linked in:
[ 45.914022] ---[ end trace 0000000000000000 ]---
[ 45.914709] RIP: 0010:lookup_peer+0x1ba/0x320
[ 45.915436] Code: 48 89 d9 ba 04 00 00 00 4c 89 fe bf a0 06 00 00 e8 2b e8 ad fb e9 56 ff ff ff e8 01 1e c3 fb 49 8d 7f 18 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 4a 01 00 00 4d 8b 47 18 4c 89 f1 ba 04 00 00 00
[ 45.919191] RSP: 0018:ffff888114d67b90 EFLAGS: 00010212
[ 45.920046] RAX: 1bd5a00000000023 RBX: 0000000000000000 RCX: ffffffff85c1d19f
[ 45.921129] RDX: ffff88810dc35700 RSI: 0000000000000000 RDI: dead000000000118
[ 45.922553] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001
[ 45.923653] R10: ffffffff893d3057 R11: ffff88810dc35700 R12: ffff88810a690000
[ 45.925119] R13: ffff888115451038 R14: ffff88810a690000 R15: dead000000000100
[ 45.926180] FS: 00007fa889bac780(0000) GS:ffff8881fd852000(0000) knlGS:0000000000000000
[ 45.927817] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 45.928726] CR2: 00007ffe304f2f80 CR3: 0000000104f64005 CR4: 0000000000770ef0
[ 45.930069] PKRU: 55555554
[ 45.930456] Kernel panic - not syncing: Fatal exception
[ 45.931542] Kernel Offset: disabled
[ 45.932040] Rebooting in 1 seconds..
Fixes: 90305829635d ("Bluetooth: 6lowpan: Converting rwlocks to use RCU")
Assisted-by: LLM
Signed-off-by: Cen Zhang <zzzccc427@gmail.com>
---
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 836add41f5..4b05409929 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1274,7 +1274,7 @@ static int device_event(struct notifier_block *unused,
if (entry->netdev == netdev) {
BT_DBG("Unregistered netdev %s %p",
netdev->name, netdev);
- list_del(&entry->list);
+ list_del_rcu(&entry->list);
break;
}
}
^ permalink raw reply related [flat|nested] 3+ messages in thread
* RE: Bluetooth: 6LoWPAN: Use RCU-safe device list removal
2026-10-06 7:35 [PATCH] Bluetooth: 6LoWPAN: Use RCU-safe device list removal Cen Zhang
@ 2026-10-06 8:31 ` bluez.test.bot
2026-10-07 17:30 ` [PATCH] " patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: bluez.test.bot @ 2026-10-06 8:31 UTC (permalink / raw)
To: linux-bluetooth, zzzccc427
[-- Attachment #1: Type: text/plain, Size: 5370 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1180108/
---Test result---
Test Summary:
CheckPatch PASS 1.25 seconds
VerifyFixes PASS 8.66 seconds
VerifySignedoff PASS 1.08 seconds
GitLint FAIL 0.39 seconds
SubjectPrefix PASS 0.16 seconds
BuildKernel PASS 22.21 seconds
CheckAllWarning PASS 26.22 seconds
CheckSparse PASS 27.78 seconds
BuildKernel32 PASS 24.03 seconds
CheckKernelLLVM PASS 25.08 seconds
TestRunnerSetup PASS 583.13 seconds
TestRunner_6lowpan-tester PASS 7.05 seconds
IncrementalBuild PASS 23.35 seconds
Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: 6LoWPAN: Use RCU-safe device list removal
44: B1 Line exceeds max length (131>80): " [ 45.867526] Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000023: 0000 [#1] SMP KASAN NOPTI"
45: B1 Line exceeds max length (99>80): " [ 45.869489] KASAN: maybe wild-memory-access in range [0xdead000000000118-0xdead00000000011f]"
46: B1 Line exceeds max length (112>80): " [ 45.870981] CPU: 1 UID: 0 PID: 646 Comm: sh Not tainted 7.2.0-rc6-pmb-bt-functional-v1+ #4 PREEMPT(lazy) "
46: B2 Line has trailing whitespace: " [ 45.870981] CPU: 1 UID: 0 PID: 646 Comm: sh Not tainted 7.2.0-rc6-pmb-bt-functional-v1+ #4 PREEMPT(lazy) "
47: B1 Line exceeds max length (134>80): " [ 45.872609] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014"
49: B1 Line exceeds max length (218>80): " [ 45.875067] Code: 48 89 d9 ba 04 00 00 00 4c 89 fe bf a0 06 00 00 e8 2b e8 ad fb e9 56 ff ff ff e8 01 1e c3 fb 49 8d 7f 18 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 4a 01 00 00 4d 8b 47 18 4c 89 f1 ba 04 00 00 00"
51: B1 Line exceeds max length (84>80): " [ 45.879106] RAX: 1bd5a00000000023 RBX: 0000000000000000 RCX: ffffffff85c1d19f"
52: B1 Line exceeds max length (84>80): " [ 45.880334] RDX: ffff88810dc35700 RSI: 0000000000000000 RDI: dead000000000118"
53: B1 Line exceeds max length (84>80): " [ 45.881455] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001"
54: B1 Line exceeds max length (84>80): " [ 45.882546] R10: ffffffff893d3057 R11: ffff88810dc35700 R12: ffff88810a690000"
55: B1 Line exceeds max length (84>80): " [ 45.883839] R13: ffff888115451038 R14: ffff88810a690000 R15: dead000000000100"
56: B1 Line exceeds max length (95>80): " [ 45.885186] FS: 00007fa889bac780(0000) GS:ffff8881fd852000(0000) knlGS:0000000000000000"
58: B1 Line exceeds max length (84>80): " [ 45.887527] CR2: 00007ffe304f2f80 CR3: 0000000104f64005 CR4: 0000000000770ef0"
82: B1 Line exceeds max length (218>80): " [ 45.904359] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff"
83: B1 Line exceeds max length (89>80): " [ 45.906981] RSP: 002b:00007ffd7651b960 EFLAGS: 00000202 ORIG_RAX: 0000000000000001"
84: B1 Line exceeds max length (84>80): " [ 45.908070] RAX: ffffffffffffffda RBX: 00007fa889bac780 RCX: 00007fa889c3e687"
85: B1 Line exceeds max length (84>80): " [ 45.909102] RDX: 000000000000001c RSI: 00005570f25e8d10 RDI: 0000000000000001"
86: B1 Line exceeds max length (84>80): " [ 45.910133] RBP: 00005570f25e8d10 R08: 0000000000000000 R09: 0000000000000000"
87: B1 Line exceeds max length (84>80): " [ 45.911162] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001"
88: B1 Line exceeds max length (84>80): " [ 45.912190] R13: 000000000000001c R14: 0000000000000000 R15: 00005570f25e8a78"
93: B1 Line exceeds max length (218>80): " [ 45.915436] Code: 48 89 d9 ba 04 00 00 00 4c 89 fe bf a0 06 00 00 e8 2b e8 ad fb e9 56 ff ff ff e8 01 1e c3 fb 49 8d 7f 18 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 4a 01 00 00 4d 8b 47 18 4c 89 f1 ba 04 00 00 00"
95: B1 Line exceeds max length (84>80): " [ 45.920046] RAX: 1bd5a00000000023 RBX: 0000000000000000 RCX: ffffffff85c1d19f"
96: B1 Line exceeds max length (84>80): " [ 45.921129] RDX: ffff88810dc35700 RSI: 0000000000000000 RDI: dead000000000118"
97: B1 Line exceeds max length (84>80): " [ 45.922553] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001"
98: B1 Line exceeds max length (84>80): " [ 45.923653] R10: ffffffff893d3057 R11: ffff88810dc35700 R12: ffff88810a690000"
99: B1 Line exceeds max length (84>80): " [ 45.925119] R13: ffff888115451038 R14: ffff88810a690000 R15: dead000000000100"
100: B1 Line exceeds max length (95>80): " [ 45.926180] FS: 00007fa889bac780(0000) GS:ffff8881fd852000(0000) knlGS:0000000000000000"
102: B1 Line exceeds max length (84>80): " [ 45.928726] CR2: 00007ffe304f2f80 CR3: 0000000104f64005 CR4: 0000000000770ef0"
https://github.com/bluez/bluetooth-next/pull/867
---
Regards,
Linux Bluetooth
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] Bluetooth: 6LoWPAN: Use RCU-safe device list removal
2026-10-06 7:35 [PATCH] Bluetooth: 6LoWPAN: Use RCU-safe device list removal Cen Zhang
2026-10-06 8:31 ` bluez.test.bot
@ 2026-10-07 17:30 ` patchwork-bot+bluetooth
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+bluetooth @ 2026-10-07 17:30 UTC (permalink / raw)
To: Cen Zhang
Cc: marcel, luiz.dentz, linux-bluetooth, linux-kernel, baijiaju1990,
jjzuming
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:
On Tue, 6 Oct 2026 15:35:23 +0800 you wrote:
> RCU readers of bt_6lowpan_devices must be able to follow an adapter's
> forward link until their read-side critical section ends. The entries
> are published with list_add_rcu(), but device_event() removes an entry
> on NETDEV_UNREGISTER with list_del(), poisoning that link.
>
> When an adapter is being unregistered and 6LoWPAN is enabled, a
> 6lowpan_control debugfs write with an existing LE L2CAP connection can
> enter lookup_peer() after unregister's first synchronize_net(). If the
> connection has no peer on that adapter, the reader must advance to the
> next list entry. Neither RTNL nor devices_lock excludes this RCU reader.
>
> [...]
Here is the summary with links:
- Bluetooth: 6LoWPAN: Use RCU-safe device list removal
https://git.kernel.org/bluetooth/bluetooth-next/c/fabf38c7e07f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-07 17:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-06 7:35 [PATCH] Bluetooth: 6LoWPAN: Use RCU-safe device list removal Cen Zhang
2026-10-06 8:31 ` bluez.test.bot
2026-10-07 17:30 ` [PATCH] " patchwork-bot+bluetooth
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox