From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99757CDB474 for ; Mon, 23 Oct 2023 11:01:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232382AbjJWLBX (ORCPT ); Mon, 23 Oct 2023 07:01:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57396 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232817AbjJWLBU (ORCPT ); Mon, 23 Oct 2023 07:01:20 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F9D510C3 for ; Mon, 23 Oct 2023 04:01:18 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0564C433CA; Mon, 23 Oct 2023 11:01:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1698058878; bh=9ZTfNpl8Feoe8vdg9cphyAJl8qwSTC2XlZDX5YnyoDQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=da2Tj7ef1fZ4gQ7763nEPoQmfid95ZixaQ50QhDlrCY0nU7IK+brhr85ABsGA2Jkf SRdflwWqRS7ZSQSqwM25C1GpZ5Lxn+oMMmGcUX/5MVUrFQJ1fzx3bJWHqpqSVaj5fv xyH7qhSwBWHdD2Xi1c0OT5Dr60iAxatF4YrEYjlw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Arkadiusz Bokowy , Luiz Augusto von Dentz Subject: [PATCH 4.14 29/66] Bluetooth: vhci: Fix race when opening vhci device Date: Mon, 23 Oct 2023 12:56:19 +0200 Message-ID: <20231023104811.914460622@linuxfoundation.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231023104810.781270702@linuxfoundation.org> References: <20231023104810.781270702@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arkadiusz Bokowy commit 92d4abd66f7080075793970fc8f241239e58a9e7 upstream. When the vhci device is opened in the two-step way, i.e.: open device then write a vendor packet with requested controller type, the device shall respond with a vendor packet which includes HCI index of created interface. When the virtual HCI is created, the host sends a reset request to the controller. This request is processed by the vhci_send_frame() function. However, this request is send by a different thread, so it might happen that this HCI request will be received before the vendor response is queued in the read queue. This results in the HCI vendor response and HCI reset request inversion in the read queue which leads to improper behavior of btvirt: > dmesg [1754256.640122] Bluetooth: MGMT ver 1.22 [1754263.023806] Bluetooth: MGMT ver 1.22 [1754265.043775] Bluetooth: hci1: Opcode 0x c03 failed: -110 In order to synchronize vhci two-step open/setup process with virtual HCI initialization, this patch adds internal lock when queuing data in the vhci_send_frame() function. Signed-off-by: Arkadiusz Bokowy Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman --- drivers/bluetooth/hci_vhci.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/bluetooth/hci_vhci.c +++ b/drivers/bluetooth/hci_vhci.c @@ -82,7 +82,10 @@ static int vhci_send_frame(struct hci_de struct vhci_data *data = hci_get_drvdata(hdev); memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); + + mutex_lock(&data->open_mutex); skb_queue_tail(&data->readq, skb); + mutex_unlock(&data->open_mutex); wake_up_interruptible(&data->read_wait); return 0;