All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Gleixner <tglx@linutronix.de>
To: LKML <linux-kernel@vger.kernel.org>
Cc: Linus Torvalds <torvalds@linuxfoundation.org>,
	Steven Rostedt <rostedt@goodmis.org>,
	Anna-Maria Behnsen <anna-maria@linutronix.de>,
	Peter Zijlstra <peterz@infradead.org>,
	Stephen Boyd <sboyd@kernel.org>,
	Guenter Roeck <linux@roeck-us.net>,
	Andrew Morton <akpm@linux-foundation.org>,
	Julia Lawall <Julia.Lawall@inria.fr>,
	Arnd Bergmann <arnd@arndb.de>,
	Viresh Kumar <viresh.kumar@linaro.org>,
	Marc Zyngier <maz@kernel.org>,
	Marcel Holtmann <marcel@holtmann.org>,
	Johan Hedberg <johan.hedberg@gmail.com>,
	Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
	linux-bluetooth@vger.kernel.org,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	netdev@vger.kernel.org
Subject: [patch V2 17/17] Bluetooth: hci_qca: Fix the teardown problem for real
Date: Tue, 22 Nov 2022 18:45:11 +0100 (CET)	[thread overview]
Message-ID: <20221122173649.075273417@linutronix.de> (raw)
In-Reply-To: 20221122171312.191765396@linutronix.de

While discussing solutions for the teardown problem which results from
circular dependencies between timers and workqueues, where timers schedule
work from their timer callback and workqueues arm the timers from work
items, it was discovered that the recent fix to the QCA code is incorrect.

That commit fixes the obvious problem of using del_timer() instead of
del_timer_sync() and reorders the teardown calls to

   destroy_workqueue(wq);
   del_timer_sync(t);

This makes it less likely to explode, but it's still broken:

   destroy_workqueue(wq);
   /* After this point @wq cannot be touched anymore */

   ---> timer expires
         queue_work(wq) <---- Results in a NULl pointer dereference
			      deep in the work queue core code.
   del_timer_sync(t);

Use the new timer_shutdown_sync() function to ensure that the timers are
disarmed, no timer callbacks are running and the timers cannot be armed
again. This restores the original teardown sequence:

   timer_shutdown_sync(t);
   destroy_workqueue(wq);

which is now correct because the timer core silently ignores potential
rearming attempts which can happen when destroy_workqueue() drains pending
work before mopping up the workqueue.

Fixes: 72ef98445aca ("Bluetooth: hci_qca: Use del_timer_sync() before freeing")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Link: https://lore.kernel.org/all/87iljhsftt.ffs@tglx
---
 drivers/bluetooth/hci_qca.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -696,9 +696,15 @@ static int qca_close(struct hci_uart *hu
 	skb_queue_purge(&qca->tx_wait_q);
 	skb_queue_purge(&qca->txq);
 	skb_queue_purge(&qca->rx_memdump_q);
+	/*
+	 * Shut the timers down so they can't be rearmed when
+	 * destroy_workqueue() drains pending work which in turn might try
+	 * to arm a timer.  After shutdown rearm attempts are silently
+	 * ignored by the timer core code.
+	 */
+	timer_shutdown_sync(&qca->tx_idle_timer);
+	timer_shutdown_sync(&qca->wake_retrans_timer);
 	destroy_workqueue(qca->workqueue);
-	del_timer_sync(&qca->tx_idle_timer);
-	del_timer_sync(&qca->wake_retrans_timer);
 	qca->hu = NULL;
 
 	kfree_skb(qca->rx_skb);


  parent reply	other threads:[~2022-11-22 17:47 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-11-22 17:44 [patch V2 00/17] timers: Provide timer_shutdown[_sync]() Thomas Gleixner
2022-11-22 17:44 ` [patch V2 01/17] Documentation: Remove bogus claim about del_timer_sync() Thomas Gleixner
2022-11-22 18:37   ` timers: Provide timer_shutdown[_sync]() bluez.test.bot
2022-11-22 17:44 ` [patch V2 02/17] ARM: spear: Do not use timer namespace for timer_shutdown() function Thomas Gleixner
2022-11-22 17:44 ` [patch V2 03/17] clocksource/drivers/arm_arch_timer: " Thomas Gleixner
2022-11-22 17:44 ` [patch V2 04/17] clocksource/drivers/sp804: " Thomas Gleixner
2022-11-22 17:44 ` [patch V2 05/17] timers: Get rid of del_singleshot_timer_sync() Thomas Gleixner
2022-11-22 17:44 ` [patch V2 06/17] timers: Replace BUG_ON()s Thomas Gleixner
2022-11-22 17:44 ` [patch V2 07/17] timers: Update kernel-doc for various functions Thomas Gleixner
2022-11-23 10:23   ` Anna-Maria Behnsen
2022-11-23 17:09     ` Thomas Gleixner
2022-11-22 17:44 ` [patch V2 08/17] timers: Use del_timer_sync() even on UP Thomas Gleixner
2022-11-22 17:44 ` [patch V2 09/17] timers: Rename del_timer_sync() to timer_delete_sync() Thomas Gleixner
2022-11-22 22:23   ` David Laight
2022-11-22 22:45     ` Steven Rostedt
2022-11-23  0:08       ` Thomas Gleixner
2022-11-23  0:28         ` Steven Rostedt
2022-11-22 17:45 ` [patch V2 10/17] timers: Rename del_timer() to timer_delete() Thomas Gleixner
2022-11-22 17:45 ` [patch V2 11/17] Documentation: Replace del_timer/del_timer_sync() Thomas Gleixner
2022-11-22 17:45 ` [patch V2 12/17] timers: Silently ignore timers with a NULL function Thomas Gleixner
2022-11-23  9:22   ` Anna-Maria Behnsen
2022-11-23 10:39   ` Anna-Maria Behnsen
2022-11-23 11:06   ` Anna-Maria Behnsen
2022-11-23 17:08     ` Thomas Gleixner
2022-11-22 17:45 ` [patch V2 13/17] timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode Thomas Gleixner
2022-11-22 23:04   ` Jacob Keller
2022-11-23 17:05     ` Thomas Gleixner
2022-11-23 18:45       ` Jacob Keller
2022-11-23 11:23   ` Anna-Maria Behnsen
2022-11-23 11:24     ` Anna-Maria Behnsen
2022-11-22 17:45 ` [patch V2 14/17] timers: Add shutdown mechanism to the internal functions Thomas Gleixner
2022-11-22 17:45 ` [patch V2 15/17] timers: Provide timer_shutdown[_sync]() Thomas Gleixner
2022-11-23 12:02   ` Anna-Maria Behnsen
2022-11-23 17:06     ` Thomas Gleixner
2022-11-22 17:45 ` [patch V2 16/17] timers: Update the documentation to reflect on the new timer_shutdown() API Thomas Gleixner
2022-11-22 17:45 ` Thomas Gleixner [this message]
2022-11-22 23:09 ` [patch V2 00/17] timers: Provide timer_shutdown[_sync]() Jacob Keller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221122173649.075273417@linutronix.de \
    --to=tglx@linutronix.de \
    --cc=Julia.Lawall@inria.fr \
    --cc=akpm@linux-foundation.org \
    --cc=anna-maria@linutronix.de \
    --cc=arnd@arndb.de \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=johan.hedberg@gmail.com \
    --cc=kuba@kernel.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@roeck-us.net \
    --cc=luiz.dentz@gmail.com \
    --cc=marcel@holtmann.org \
    --cc=maz@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=sboyd@kernel.org \
    --cc=torvalds@linuxfoundation.org \
    --cc=viresh.kumar@linaro.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.