Re: [2.4] "Fix" introduced in 2.4.27pre2 for bluetooth hci_usb race causes kernel hang

[Marcel Holtmann <marcel@holtmann.org>]

[-- Attachment #1: Type: text/plain, Size: 1067 bytes --]

Hi Tomas,

> > > I have noticed a problem with a race condition fix introduced in
> > > 2.4.27-pre2 that causes the kernel to hang when disconnecting a
> > > Bluetooth USB dongle or doing 'hciconfig hci0 down'. No message is
> > > printed, the kernel just doesn't respond anymore.
> > > 
> > > Seen in Changelog:
> > > Marcel Holtmann:
> > >   o [Bluetooth] Fix race in RX complete routine of the USB drivers
> > > 
> > > Reversing the following patch to hci_usb_rx_complete() makes 2.4.27-pre2
> > > up until 2.4.30 happy and does not hang when removing the dongle
> > > anymore. (bfusb.c has the same patch applied)
> > > 
> > > 2.6.11.7 does not show the same problem, but has similar code to the
> > > "fixed" (that hangs) code in 2.4, so the real problem is probably
> > > somewhere else.
> > 
> > does the attached patch makes any difference?
> 
> It works just fine with pristine 2.4.30 and this patch. No deadlocks
> anymore.

if this works then we should do the same change in the bfusb driver. A
patch that fixes both drivers is attached.

Regards

Marcel


[-- Attachment #2: patch --]
[-- Type: text/plain, Size: 978 bytes --]

===== drivers/bluetooth/bfusb.c 1.3 vs edited =====
--- 1.3/drivers/bluetooth/bfusb.c	2004-04-16 14:01:40 +02:00
+++ edited/drivers/bluetooth/bfusb.c	2005-04-13 12:49:55 +02:00
@@ -470,11 +470,10 @@
 		return 0;
 
 	write_lock_irqsave(&bfusb->lock, flags);
+	write_unlock_irqrestore(&bfusb->lock, flags);
 
 	bfusb_unlink_urbs(bfusb);
 	bfusb_flush(hdev);
-
-	write_unlock_irqrestore(&bfusb->lock, flags);
 
 	MOD_DEC_USE_COUNT;
 
===== drivers/bluetooth/hci_usb.c 1.23 vs edited =====
--- 1.23/drivers/bluetooth/hci_usb.c	2004-07-31 13:02:43 +02:00
+++ edited/drivers/bluetooth/hci_usb.c	2005-04-09 15:37:12 +02:00
@@ -398,12 +398,12 @@
 
 	BT_DBG("%s", hdev->name);
 
+	/* Synchronize with completion handlers */
 	write_lock_irqsave(&husb->completion_lock, flags);
-	
+	write_unlock_irqrestore(&husb->completion_lock, flags);
+
 	hci_usb_unlink_urbs(husb);
 	hci_usb_flush(hdev);
-
-	write_unlock_irqrestore(&husb->completion_lock, flags);
 
 	MOD_DEC_USE_COUNT;
 	return 0;