[PATCH 0/2] Bluetooth: SMP: Serialize root channel updates

[Cen Zhang <zzzccc427@gmail.com>]

The SMP root channels in hdev->smp_data and hdev->smp_bredr_data are
used by HCI event processing under hdev->lock and by SMP receive
callbacks on hdev->workqueue. Power-off already removes them under
hdev->lock in hci_dev_close_sync(). Two other writers do not serialize
with these users:

  1/2 The force_bredr_smp debugfs switch creates and removes the BR/EDR
      root without hdev->lock. A connection confirmation can see a root
      whose operations are not set yet, and a disable can race with
      power-off and release the channel twice. Take hdev->lock in the
      writer, and skip the deletion when power-off already emptied the
      slot.

  2/2 smp_register() replaces both roots when management powers on a
      controller that is already up with HCI_AUTO_OFF set, while HCI
      event processing and SMP receive callbacks can still be using the
      old roots. Run the registration on hdev->workqueue, where it ran
      before commit 2ff13894cfb8 ("Bluetooth: Perform HCI update for
      power on synchronously"), and hold hdev->lock while it replaces
      the roots. The caller waits for the work without holding
      hdev->lock, which HCI event processing on that workqueue takes.

smp_register() still warns when it replaces the channels on that path.
This series only makes the replacement safe.

Cen Zhang (2):
  Bluetooth: SMP: Serialize forced BR/EDR channel changes
  Bluetooth: SMP: Serialize root channel replacement

 net/bluetooth/hci_debugfs.c |  2 ++
 net/bluetooth/smp.c         | 38 +++++++++++++++++++++++++++++++++++--
 net/bluetooth/smp.h         |  3 ++-
 3 files changed, 40 insertions(+), 3 deletions(-)

---