[PATCH] Bluetooth: hci_core: Check HCI_CMD_DRAIN_WORKQUEUE in hci_cmd_timeout()

[PATCH] Bluetooth: hci_core: Check HCI_CMD_DRAIN_WORKQUEUE in hci_cmd_timeout()

[Yang Guikun]

Bluetooth: hci_core: Check HCI_CMD_DRAIN_WORKQUEUE in hci_cmd_timeout()

hci_cmd_timeout() runs from timer softirq and queues cmd_work
unconditionally.  If the timer expires while hci_dev_close_sync() is
in drain_workqueue(), __queue_work() sees __WQ_DRAINING and warns:

  workqueue: cannot queue hci_cmd_timeout on wq hci0

cmd_timer is cancelled only after drain_workqueue(), so the window
between them is reachable when an HCI device with a command outstanding
is powered off via rfkill.

hci_cmd_work() and handle_cmd_cnt_and_timer() already skip queuing when
HCI_CMD_DRAIN_WORKQUEUE is set; hci_cmd_timeout() is the remaining
unchecked producer.

Fixes: 525daaea459f ("Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close")
Signed-off-by: Yang Guikun <yangguikun19@qq.com>
---
 net/bluetooth/hci_core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 209244fd9391..3333333333333 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1441,7 +1441,10 @@ static void hci_cmd_timeout(struct work_struct *work)
 		hdev->reset(hdev);
 
 	atomic_set(&hdev->cmd_cnt, 1);
-	queue_work(hdev->workqueue, &hdev->cmd_work);
+	rcu_read_lock();
+	if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
+		queue_work(hdev->workqueue, &hdev->cmd_work);
+	rcu_read_unlock();
 }
 
 /* HCI ncmd timer function */
--
2.39.5

RE: Bluetooth: hci_core: Check HCI_CMD_DRAIN_WORKQUEUE in hci_cmd_timeout()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1605 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1195247/

---Test result---

Test Summary:
CheckPatch                    PASS      0.57 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      8.42 seconds
GitLint                       PASS      3.10 seconds
SubjectPrefix                 PASS      0.16 seconds
BuildKernel                   PASS      22.62 seconds
CheckAllWarning               PASS      25.92 seconds
CheckSparse                   PASS      27.36 seconds
BuildKernel32                 PASS      22.66 seconds
CheckKernelLLVM               PASS      25.13 seconds
TestRunnerSetup               PASS      523.86 seconds
TestRunner_l2cap-tester       PASS      13.58 seconds
TestRunner_iso-tester         PASS      9.61 seconds
TestRunner_bnep-tester        PASS      2.78 seconds
TestRunner_mgmt-tester        PASS      83.76 seconds
TestRunner_rfcomm-tester      PASS      4.04 seconds
TestRunner_sco-tester         PASS      5.04 seconds
TestRunner_ioctl-tester       PASS      4.18 seconds
TestRunner_mesh-tester        PASS      5.05 seconds
TestRunner_smp-tester         PASS      3.98 seconds
TestRunner_userchan-tester    PASS      2.84 seconds
TestRunner_6lowpan-tester     PASS      3.96 seconds
IncrementalBuild              PASS      21.38 seconds



https://github.com/bluez/bluetooth-next/pull/1015

---
Regards,
Linux Bluetooth