All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] Bluetooth: Fix "blocking ops when !TASK_RUNNING" with sock_accept
@ 2015-01-23 12:03 Johan Hedberg
  2015-01-23 12:43 ` Johan Hedberg
  2015-01-23 17:08 ` [PATCH] bluetooth: Fix nested sleeps Peter Hurley
  0 siblings, 2 replies; 6+ messages in thread
From: Johan Hedberg @ 2015-01-23 12:03 UTC (permalink / raw)
  To: linux-bluetooth

From: Johan Hedberg <johan.hedberg@intel.com>

Recent kernels have started giving the following style warnings:

[  +0.000237] WARNING: CPU: 1 PID: 701 at kernel/sched/core.c:7300 __might_sleep+0x65/0xa3()
[  +0.000407] do not call blocking ops when !TASK_RUNNING; state=1 set at [<f88b0955>] l2cap_sock_accept+0x97/0x1b4 [bluetooth]
[  +0.000611] Modules linked in: btusb hci_vhci rfcomm bluetooth
[  +0.000305] CPU: 1 PID: 701 Comm: l2cap-tester Not tainted 3.19.0-rc4+ #1304
[  +0.000318] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014
[  +0.000463]  00000000 00000000 f2e81c70 c13e57df f2e81c9c f2e81c8c c103372c 00001c84
[  +0.000586]  c104e4a1 00000001 f5e93390 f5e93390 f2e81ca4 c103376e 00000009 f2e81c9c
[  +0.000422]  c15da812 f2e81cb8 f2e81cdc c104e4a1 c15da2ae 00001c84 c15da812 00000001
[  +0.000869] Call Trace:
[  +0.000073]  [<c13e57df>] dump_stack+0x49/0x73
[  +0.000182]  [<c103372c>] warn_slowpath_common+0x89/0xa0
[  +0.000225]  [<c104e4a1>] ? __might_sleep+0x65/0xa3
[  +0.000204]  [<c103376e>] warn_slowpath_fmt+0x2b/0x2f
[  +0.000215]  [<c104e4a1>] __might_sleep+0x65/0xa3
[  +0.000212]  [<f88b0955>] ? l2cap_sock_accept+0x97/0x1b4 [bluetooth]
[  +0.000297]  [<f88b0955>] ? l2cap_sock_accept+0x97/0x1b4 [bluetooth]
[  +0.000284]  [<c130bfad>] lock_sock_nested+0x23/0x77
[  +0.000219]  [<f888b25d>] bt_accept_dequeue+0x68/0x11b [bluetooth]
[  +0.000274]  [<c1060165>] ? trace_hardirqs_on+0xb/0xd
[  +0.000224]  [<f88b0985>] l2cap_sock_accept+0xc7/0x1b4 [bluetooth]
[  +0.000498]  [<f88b0985>] ? l2cap_sock_accept+0xc7/0x1b4 [bluetooth]
[  +0.000494]  [<c1051849>] ? wake_up_state+0x11/0x11
[  +0.000202]  [<c1309c27>] SYSC_accept4+0xf3/0x1af
[  +0.000194]  [<c11912b5>] ? security_socket_accept+0x14/0x16
[  +0.000252]  [<c1309c27>] ? SYSC_accept4+0xf3/0x1af
[  +0.000201]  [<c1061507>] ? lock_release_non_nested+0x137/0x217
[  +0.000256]  [<c10cd5bc>] ? might_fault+0x44/0x8b
[  +0.000190]  [<c10cd5bc>] ? might_fault+0x44/0x8b
[  +0.000196]  [<c11da2b0>] ? _copy_from_user+0x44/0x4e
[  +0.000210]  [<c130b3ea>] SYSC_socketcall+0xff/0x38c
[  +0.000205]  [<c105fdcb>] ? mark_lock+0x1e/0x1c5
[  +0.000186]  [<c10606d8>] ? __lock_acquire+0x342/0xc89
[  +0.000215]  [<c1060926>] ? __lock_acquire+0x590/0xc89
[  +0.000217]  [<c105ea2e>] ? __lock_is_held+0x2e/0x44
[  +0.000205]  [<c11106c9>] ? fsnotify+0x452/0x494
[  +0.000186]  [<c1060165>] ? trace_hardirqs_on+0xb/0xd
[  +0.000403]  [<c10e4516>] ? fsnotify_modify+0x4a/0x55
[  +0.000497]  [<c10e4516>] ? fsnotify_modify+0x4a/0x55
[  +0.000220]  [<c10e48eb>] ? vfs_write+0xbb/0xc5
[  +0.000186]  [<c106013f>] ? trace_hardirqs_on_caller+0x15f/0x17a
[  +0.000273]  [<c130b6a8>] SyS_socketcall+0x13/0x15
[  +0.000200]  [<c13ea628>] sysenter_do_call+0x12/0x12

The problematic code is bt_accept_dequeue() which calls the blocking
lock_sock() function. The simplest fix is to move setting
TASK_INTERRUPTIBLE after the call to bt_accept_dequeue(). This patch
makes this fix for our three socket types (L2CAP, RFCOMM & SCO).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---
Note: Due to my limited experience with waitqueues and playing with the
task state, this can be considered a rather naive approach to the
problem. However, the patch seems to work fine in practice and
effectively removes the warning in question.

 net/bluetooth/l2cap_sock.c  | 4 ++--
 net/bluetooth/rfcomm/sock.c | 4 ++--
 net/bluetooth/sco.c         | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 20206cd3acbc..8d723e6ae802 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -316,8 +316,6 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -327,6 +325,8 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 		if (nsk)
 			break;
 
+		set_current_state(TASK_INTERRUPTIBLE);
+
 		if (!timeo) {
 			err = -EAGAIN;
 			break;
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index d8a95755a8a8..8f492707f6d2 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -487,8 +487,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -498,6 +496,8 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 		if (nsk)
 			break;
 
+		set_current_state(TASK_INTERRUPTIBLE);
+
 		if (!timeo) {
 			err = -EAGAIN;
 			break;
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 07ec7d23b843..ee9673e014cb 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -632,8 +632,6 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -643,6 +641,8 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 		if (ch)
 			break;
 
+		set_current_state(TASK_INTERRUPTIBLE);
+
 		if (!timeo) {
 			err = -EAGAIN;
 			break;
-- 
2.1.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: Fix "blocking ops when !TASK_RUNNING" with sock_accept
  2015-01-23 12:03 [PATCH] Bluetooth: Fix "blocking ops when !TASK_RUNNING" with sock_accept Johan Hedberg
@ 2015-01-23 12:43 ` Johan Hedberg
  2015-01-23 13:49   ` Peter Hurley
  2015-01-23 17:08 ` [PATCH] bluetooth: Fix nested sleeps Peter Hurley
  1 sibling, 1 reply; 6+ messages in thread
From: Johan Hedberg @ 2015-01-23 12:43 UTC (permalink / raw)
  To: linux-bluetooth; +Cc: peter

Hi,

On Fri, Jan 23, 2015, Johan Hedberg wrote:
> Recent kernels have started giving the following style warnings:
> 
> [  +0.000237] WARNING: CPU: 1 PID: 701 at kernel/sched/core.c:7300 __might_sleep+0x65/0xa3()
> [  +0.000407] do not call blocking ops when !TASK_RUNNING; state=1 set at [<f88b0955>] l2cap_sock_accept+0x97/0x1b4 [bluetooth]
> [  +0.000611] Modules linked in: btusb hci_vhci rfcomm bluetooth
> [  +0.000305] CPU: 1 PID: 701 Comm: l2cap-tester Not tainted 3.19.0-rc4+ #1304
> [  +0.000318] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014
> [  +0.000463]  00000000 00000000 f2e81c70 c13e57df f2e81c9c f2e81c8c c103372c 00001c84
> [  +0.000586]  c104e4a1 00000001 f5e93390 f5e93390 f2e81ca4 c103376e 00000009 f2e81c9c
> [  +0.000422]  c15da812 f2e81cb8 f2e81cdc c104e4a1 c15da2ae 00001c84 c15da812 00000001
> [  +0.000869] Call Trace:
> [  +0.000073]  [<c13e57df>] dump_stack+0x49/0x73
> [  +0.000182]  [<c103372c>] warn_slowpath_common+0x89/0xa0
> [  +0.000225]  [<c104e4a1>] ? __might_sleep+0x65/0xa3
> [  +0.000204]  [<c103376e>] warn_slowpath_fmt+0x2b/0x2f
> [  +0.000215]  [<c104e4a1>] __might_sleep+0x65/0xa3
> [  +0.000212]  [<f88b0955>] ? l2cap_sock_accept+0x97/0x1b4 [bluetooth]
> [  +0.000297]  [<f88b0955>] ? l2cap_sock_accept+0x97/0x1b4 [bluetooth]
> [  +0.000284]  [<c130bfad>] lock_sock_nested+0x23/0x77
> [  +0.000219]  [<f888b25d>] bt_accept_dequeue+0x68/0x11b [bluetooth]
> [  +0.000274]  [<c1060165>] ? trace_hardirqs_on+0xb/0xd
> [  +0.000224]  [<f88b0985>] l2cap_sock_accept+0xc7/0x1b4 [bluetooth]
> [  +0.000498]  [<f88b0985>] ? l2cap_sock_accept+0xc7/0x1b4 [bluetooth]
> [  +0.000494]  [<c1051849>] ? wake_up_state+0x11/0x11
> [  +0.000202]  [<c1309c27>] SYSC_accept4+0xf3/0x1af
> [  +0.000194]  [<c11912b5>] ? security_socket_accept+0x14/0x16
> [  +0.000252]  [<c1309c27>] ? SYSC_accept4+0xf3/0x1af
> [  +0.000201]  [<c1061507>] ? lock_release_non_nested+0x137/0x217
> [  +0.000256]  [<c10cd5bc>] ? might_fault+0x44/0x8b
> [  +0.000190]  [<c10cd5bc>] ? might_fault+0x44/0x8b
> [  +0.000196]  [<c11da2b0>] ? _copy_from_user+0x44/0x4e
> [  +0.000210]  [<c130b3ea>] SYSC_socketcall+0xff/0x38c
> [  +0.000205]  [<c105fdcb>] ? mark_lock+0x1e/0x1c5
> [  +0.000186]  [<c10606d8>] ? __lock_acquire+0x342/0xc89
> [  +0.000215]  [<c1060926>] ? __lock_acquire+0x590/0xc89
> [  +0.000217]  [<c105ea2e>] ? __lock_is_held+0x2e/0x44
> [  +0.000205]  [<c11106c9>] ? fsnotify+0x452/0x494
> [  +0.000186]  [<c1060165>] ? trace_hardirqs_on+0xb/0xd
> [  +0.000403]  [<c10e4516>] ? fsnotify_modify+0x4a/0x55
> [  +0.000497]  [<c10e4516>] ? fsnotify_modify+0x4a/0x55
> [  +0.000220]  [<c10e48eb>] ? vfs_write+0xbb/0xc5
> [  +0.000186]  [<c106013f>] ? trace_hardirqs_on_caller+0x15f/0x17a
> [  +0.000273]  [<c130b6a8>] SyS_socketcall+0x13/0x15
> [  +0.000200]  [<c13ea628>] sysenter_do_call+0x12/0x12
> 
> The problematic code is bt_accept_dequeue() which calls the blocking
> lock_sock() function. The simplest fix is to move setting
> TASK_INTERRUPTIBLE after the call to bt_accept_dequeue(). This patch
> makes this fix for our three socket types (L2CAP, RFCOMM & SCO).
> 
> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
> ---
> Note: Due to my limited experience with waitqueues and playing with the
> task state, this can be considered a rather naive approach to the
> problem. However, the patch seems to work fine in practice and
> effectively removes the warning in question.
> 
>  net/bluetooth/l2cap_sock.c  | 4 ++--
>  net/bluetooth/rfcomm/sock.c | 4 ++--
>  net/bluetooth/sco.c         | 4 ++--
>  3 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> index 20206cd3acbc..8d723e6ae802 100644
> --- a/net/bluetooth/l2cap_sock.c
> +++ b/net/bluetooth/l2cap_sock.c
> @@ -316,8 +316,6 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
>  	/* Wait for an incoming connection. (wake-one). */
>  	add_wait_queue_exclusive(sk_sleep(sk), &wait);
>  	while (1) {
> -		set_current_state(TASK_INTERRUPTIBLE);
> -
>  		if (sk->sk_state != BT_LISTEN) {
>  			err = -EBADFD;
>  			break;
> @@ -327,6 +325,8 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
>  		if (nsk)
>  			break;
>  
> +		set_current_state(TASK_INTERRUPTIBLE);
> +
>  		if (!timeo) {
>  			err = -EAGAIN;
>  			break;

Szymon pointed out that this change is mostly reverting fixes from Peter
Hurley from a few years back, i.e. the following commits:

	552b0d3cb9ff648aa503011ef50ca24019cd0f5f
	f9a3c20aa07462108fc6fd759dea956053f020bb
	950e2d51e866623e4c360280aa63b85ab66d3403

So my patch is probably not the right fix for the issue. Any further
ideas on how to properly fix this are welcome. I didn't manage to find
anything similar to our accept_q in other (non-Bluetooth) socket types,
so I'm a bit lost why exactly it's needed in the first place.

Johan

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH] Bluetooth: Fix "blocking ops when !TASK_RUNNING" with sock_accept
  2015-01-23 12:43 ` Johan Hedberg
@ 2015-01-23 13:49   ` Peter Hurley
  0 siblings, 0 replies; 6+ messages in thread
From: Peter Hurley @ 2015-01-23 13:49 UTC (permalink / raw)
  To: Johan Hedberg; +Cc: linux-bluetooth

Hi Johan,

On 01/23/2015 07:43 AM, Johan Hedberg wrote:
> Szymon pointed out that this change is mostly reverting fixes from Peter
> Hurley from a few years back, i.e. the following commits:
> 
> 	552b0d3cb9ff648aa503011ef50ca24019cd0f5f
> 	f9a3c20aa07462108fc6fd759dea956053f020bb
> 	950e2d51e866623e4c360280aa63b85ab66d3403
> 
> So my patch is probably not the right fix for the issue. Any further
> ideas on how to properly fix this are welcome. I didn't manage to find
> anything similar to our accept_q in other (non-Bluetooth) socket types,
> so I'm a bit lost why exactly it's needed in the first place.

Thanks for letting me know about this; I'll take care of it.

Regards,
Peter Hurley

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH] bluetooth: Fix nested sleeps
  2015-01-23 12:03 [PATCH] Bluetooth: Fix "blocking ops when !TASK_RUNNING" with sock_accept Johan Hedberg
  2015-01-23 12:43 ` Johan Hedberg
@ 2015-01-23 17:08 ` Peter Hurley
  2015-01-23 17:16   ` [PATCH v2] " Peter Hurley
  1 sibling, 1 reply; 6+ messages in thread
From: Peter Hurley @ 2015-01-23 17:08 UTC (permalink / raw)
  To: Johan Hedberg, linux-bluetooth; +Cc: Peter Hurley

l2cap/rfcomm/sco_sock_accept() are wait loops which may acquire
sleeping locks. Since both wait loops and sleeping locks use
task_struct.state to sleep and wake, the nested sleeping locks
destroy the wait loop state.

Use the newly-minted wait_woken() and DEFINE_WAIT_FUNC() for the
wait loop. DEFINE_WAIT_FUNC() allows an alternate wake function
to be specified; in this case, the predefined scheduler function,
woken_wait_function(). This wait construct ensures wakeups will
not be missed without requiring the wait loop to set the
task state before condition evaluation. How this works:

 CPU 0                            |  CPU 1
                                  |
                                  | is <condition> set?
                                  | no
set <condition>                   |
                                  |
wake_up_interruptible             |
  woken_wake_function             |
    set WQ_FLAG_WOKEN             |
    try_to_wake_up                |
                                  | wait_woken
                                  |   set TASK_INTERRUPTIBLE
                                  |   WQ_FLAG_WOKEN? yes
                                  |
                                  | set TASK_RUNNING
                                  | loop
				  |
				  | is <condition> set?
                                  | yes - exit wait loop

Fixes "do not call blocking ops when !TASK_RUNNING" warnings
in l2cap_sock_accept(), rfcomm_sock_accept() and sco_sock_accept().

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
---
 net/bluetooth/l2cap_sock.c  | 9 ++++-----
 net/bluetooth/rfcomm/sock.c | 9 ++++-----
 net/bluetooth/sco.c         | 8 +++-----
 3 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index f65caf4..c41c689 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -302,7 +302,7 @@ done:
 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 			     int flags)
 {
-	DECLARE_WAITQUEUE(wait, current);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sock *sk = sock->sk, *nsk;
 	long timeo;
 	int err = 0;
@@ -316,8 +316,6 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -338,10 +336,11 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 		}
 
 		release_sock(sk);
-		timeo = schedule_timeout(timeo);
+
+		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+
 		lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 	}
-	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(sk_sleep(sk), &wait);
 
 	if (err)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 2348176..0f985ff 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -468,7 +468,7 @@ done:
 
 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 {
-	DECLARE_WAITQUEUE(wait, current);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sock *sk = sock->sk, *nsk;
 	long timeo;
 	int err = 0;
@@ -487,8 +487,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -509,10 +507,11 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 		}
 
 		release_sock(sk);
-		timeo = schedule_timeout(timeo);
+
+		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+
 		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 	}
-	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(sk_sleep(sk), &wait);
 
 	if (err)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 30e5ea3..b935003 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -618,7 +618,7 @@ done:
 
 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 {
-	DECLARE_WAITQUEUE(wait, current);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sock *sk = sock->sk, *ch;
 	long timeo;
 	int err = 0;
@@ -632,8 +632,6 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -654,10 +652,10 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 		}
 
 		release_sock(sk);
-		timeo = schedule_timeout(timeo);
+
+		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 		lock_sock(sk);
 	}
-	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(sk_sleep(sk), &wait);
 
 	if (err)
-- 
2.2.2


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH v2] bluetooth: Fix nested sleeps
  2015-01-23 17:08 ` [PATCH] bluetooth: Fix nested sleeps Peter Hurley
@ 2015-01-23 17:16   ` Peter Hurley
  2015-01-23 18:30     ` Johan Hedberg
  0 siblings, 1 reply; 6+ messages in thread
From: Peter Hurley @ 2015-01-23 17:16 UTC (permalink / raw)
  To: Johan Hedberg, linux-bluetooth; +Cc: Peter Hurley

l2cap/rfcomm/sco_sock_accept() are wait loops which may acquire
sleeping locks. Since both wait loops and sleeping locks use
task_struct.state to sleep and wake, the nested sleeping locks
destroy the wait loop state.

Use the newly-minted wait_woken() and DEFINE_WAIT_FUNC() for the
wait loop. DEFINE_WAIT_FUNC() allows an alternate wake function
to be specified; in this case, the predefined scheduler function,
woken_wake_function(). This wait construct ensures wakeups will
not be missed without requiring the wait loop to set the
task state before condition evaluation. How this works:

 CPU 0                            |  CPU 1
                                  |
                                  | is <condition> set?
                                  | no
set <condition>                   |
                                  |
wake_up_interruptible             |
  woken_wake_function             |
    set WQ_FLAG_WOKEN             |
    try_to_wake_up                |
                                  | wait_woken
                                  |   set TASK_INTERRUPTIBLE
                                  |   WQ_FLAG_WOKEN? yes
                                  |   set TASK_RUNNING
                                  |
                                  | - loop -
				  |
				  | is <condition> set?
                                  | yes - exit wait loop

Fixes "do not call blocking ops when !TASK_RUNNING" warnings
in l2cap_sock_accept(), rfcomm_sock_accept() and sco_sock_accept().

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
---

v2: minor commit log fixes
    * s/woken_wait_function/woken_wake_function/
    * indent 'set TASK_RUNNING' under wait_woken to clarify
      wait_woken() performs that operation

 net/bluetooth/l2cap_sock.c  | 9 ++++-----
 net/bluetooth/rfcomm/sock.c | 9 ++++-----
 net/bluetooth/sco.c         | 8 +++-----
 3 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index f65caf4..c41c689 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -302,7 +302,7 @@ done:
 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 			     int flags)
 {
-	DECLARE_WAITQUEUE(wait, current);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sock *sk = sock->sk, *nsk;
 	long timeo;
 	int err = 0;
@@ -316,8 +316,6 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -338,10 +336,11 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 		}
 
 		release_sock(sk);
-		timeo = schedule_timeout(timeo);
+
+		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+
 		lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 	}
-	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(sk_sleep(sk), &wait);
 
 	if (err)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 2348176..0f985ff 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -468,7 +468,7 @@ done:
 
 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 {
-	DECLARE_WAITQUEUE(wait, current);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sock *sk = sock->sk, *nsk;
 	long timeo;
 	int err = 0;
@@ -487,8 +487,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -509,10 +507,11 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 		}
 
 		release_sock(sk);
-		timeo = schedule_timeout(timeo);
+
+		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
+
 		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 	}
-	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(sk_sleep(sk), &wait);
 
 	if (err)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 30e5ea3..b935003 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -618,7 +618,7 @@ done:
 
 static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 {
-	DECLARE_WAITQUEUE(wait, current);
+	DEFINE_WAIT_FUNC(wait, woken_wake_function);
 	struct sock *sk = sock->sk, *ch;
 	long timeo;
 	int err = 0;
@@ -632,8 +632,6 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 	/* Wait for an incoming connection. (wake-one). */
 	add_wait_queue_exclusive(sk_sleep(sk), &wait);
 	while (1) {
-		set_current_state(TASK_INTERRUPTIBLE);
-
 		if (sk->sk_state != BT_LISTEN) {
 			err = -EBADFD;
 			break;
@@ -654,10 +652,10 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
 		}
 
 		release_sock(sk);
-		timeo = schedule_timeout(timeo);
+
+		timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 		lock_sock(sk);
 	}
-	__set_current_state(TASK_RUNNING);
 	remove_wait_queue(sk_sleep(sk), &wait);
 
 	if (err)
-- 
2.2.2


^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [PATCH v2] bluetooth: Fix nested sleeps
  2015-01-23 17:16   ` [PATCH v2] " Peter Hurley
@ 2015-01-23 18:30     ` Johan Hedberg
  0 siblings, 0 replies; 6+ messages in thread
From: Johan Hedberg @ 2015-01-23 18:30 UTC (permalink / raw)
  To: Peter Hurley; +Cc: linux-bluetooth

Hi Peter,

On Fri, Jan 23, 2015, Peter Hurley wrote:
> l2cap/rfcomm/sco_sock_accept() are wait loops which may acquire
> sleeping locks. Since both wait loops and sleeping locks use
> task_struct.state to sleep and wake, the nested sleeping locks
> destroy the wait loop state.
> 
> Use the newly-minted wait_woken() and DEFINE_WAIT_FUNC() for the
> wait loop. DEFINE_WAIT_FUNC() allows an alternate wake function
> to be specified; in this case, the predefined scheduler function,
> woken_wake_function(). This wait construct ensures wakeups will
> not be missed without requiring the wait loop to set the
> task state before condition evaluation. How this works:
> 
>  CPU 0                            |  CPU 1
>                                   |
>                                   | is <condition> set?
>                                   | no
> set <condition>                   |
>                                   |
> wake_up_interruptible             |
>   woken_wake_function             |
>     set WQ_FLAG_WOKEN             |
>     try_to_wake_up                |
>                                   | wait_woken
>                                   |   set TASK_INTERRUPTIBLE
>                                   |   WQ_FLAG_WOKEN? yes
>                                   |   set TASK_RUNNING
>                                   |
>                                   | - loop -
> 				  |
> 				  | is <condition> set?
>                                   | yes - exit wait loop
> 
> Fixes "do not call blocking ops when !TASK_RUNNING" warnings
> in l2cap_sock_accept(), rfcomm_sock_accept() and sco_sock_accept().
> 
> Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
> ---
> 
> v2: minor commit log fixes
>     * s/woken_wait_function/woken_wake_function/
>     * indent 'set TASK_RUNNING' under wait_woken to clarify
>       wait_woken() performs that operation
> 
>  net/bluetooth/l2cap_sock.c  | 9 ++++-----
>  net/bluetooth/rfcomm/sock.c | 9 ++++-----
>  net/bluetooth/sco.c         | 8 +++-----
>  3 files changed, 11 insertions(+), 15 deletions(-)

Applied to bluetooth-next. Thanks!

Johan

^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2015-01-23 18:30 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-23 12:03 [PATCH] Bluetooth: Fix "blocking ops when !TASK_RUNNING" with sock_accept Johan Hedberg
2015-01-23 12:43 ` Johan Hedberg
2015-01-23 13:49   ` Peter Hurley
2015-01-23 17:08 ` [PATCH] bluetooth: Fix nested sleeps Peter Hurley
2015-01-23 17:16   ` [PATCH v2] " Peter Hurley
2015-01-23 18:30     ` Johan Hedberg

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.