All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>,
	Luiz Augusto von Dentz <luiz.von.dentz@intel.com>,
	Sasha Levin <sashal@kernel.org>,
	marcel@holtmann.org, johan.hedberg@gmail.com,
	luiz.dentz@gmail.com, linux-bluetooth@vger.kernel.org
Subject: [PATCH AUTOSEL 6.5 23/52] Bluetooth: vhci: Fix race when opening vhci device
Date: Sun, 29 Oct 2023 18:53:10 -0400	[thread overview]
Message-ID: <20231029225441.789781-23-sashal@kernel.org> (raw)
In-Reply-To: <20231029225441.789781-1-sashal@kernel.org>

From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>

[ Upstream commit 92d4abd66f7080075793970fc8f241239e58a9e7 ]

When the vhci device is opened in the two-step way, i.e.: open device
then write a vendor packet with requested controller type, the device
shall respond with a vendor packet which includes HCI index of created
interface.

When the virtual HCI is created, the host sends a reset request to the
controller. This request is processed by the vhci_send_frame() function.
However, this request is send by a different thread, so it might happen
that this HCI request will be received before the vendor response is
queued in the read queue. This results in the HCI vendor response and
HCI reset request inversion in the read queue which leads to improper
behavior of btvirt:

> dmesg
[1754256.640122] Bluetooth: MGMT ver 1.22
[1754263.023806] Bluetooth: MGMT ver 1.22
[1754265.043775] Bluetooth: hci1: Opcode 0x c03 failed: -110

In order to synchronize vhci two-step open/setup process with virtual
HCI initialization, this patch adds internal lock when queuing data in
the vhci_send_frame() function.

Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/hci_vhci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 40e2b9fa11a26..f3892e9ce800f 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -74,7 +74,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 	struct vhci_data *data = hci_get_drvdata(hdev);
 
 	memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
+
+	mutex_lock(&data->open_mutex);
 	skb_queue_tail(&data->readq, skb);
+	mutex_unlock(&data->open_mutex);
 
 	wake_up_interruptible(&data->read_wait);
 	return 0;
-- 
2.42.0


  parent reply	other threads:[~2023-10-29 22:56 UTC|newest]

Thread overview: 72+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-29 22:52 [PATCH AUTOSEL 6.5 01/52] fbdev: atyfb: only use ioremap_uc() on i386 and ia64 Sasha Levin
2023-10-29 22:52 ` Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 02/52] fs/ntfs3: Add ckeck in ni_update_parent() Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 03/52] fs/ntfs3: Write immediately updated ntfs state Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 04/52] fs/ntfs3: Use kvmalloc instead of kmalloc(... __GFP_NOWARN) Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 05/52] fs/ntfs3: Add more attributes checks in mi_enum_attr() Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 06/52] fs/ntfs3: fix deadlock in mark_as_free_ex Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 07/52] fs/ntfs3: Fix shift-out-of-bounds in ntfs_fill_super Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 08/52] fs/ntfs3: Fix alternative boot searching Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 09/52] fs/ntfs3: Add more info into /proc/fs/ntfs3/<dev>/volinfo Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 10/52] fs/ntfs3: Do not allow to change label if volume is read-only Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 11/52] fs/ntfs3: Fix possible NULL-ptr-deref in ni_readpage_cmpr() Sasha Levin
2023-10-29 22:52 ` [PATCH AUTOSEL 6.5 12/52] fs/ntfs3: Fix NULL pointer dereference on error in attr_allocate_frame() Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 13/52] fs/ntfs3: Fix possible null-pointer dereference in hdr_find_e() Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 14/52] fs/ntfs3: Fix directory element type detection Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 15/52] fs/ntfs3: Avoid possible memory leak Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 16/52] spi: npcm-fiu: Fix UMA reads when dummy.nbytes == 0 Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 17/52] nvme-rdma: do not try to stop unallocated queues Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 18/52] ASoC: soc-dapm: Add helper for comparing widget name Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 19/52] ASoC: codecs: wsa-macro: handle component name prefix Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 20/52] net: ipv6: fix return value check in esp_remove_trailer Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 21/52] net: ipv4: " Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 22/52] nfs42: client needs to strip file mode's suid/sgid bit after ALLOCATE op Sasha Levin
2023-10-29 22:53 ` Sasha Levin [this message]
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 24/52] netfilter: nfnetlink_log: silence bogus compiler warning Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 25/52] net/mlx5: Bridge, fix peer entry ageing in LAG mode Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 26/52] x86/efistub: Don't try to print after ExitBootService() Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 27/52] efi: fix memory leak in krealloc failure handling Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 28/52] ASoC: rt5650: fix the wrong result of key button Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 29/52] ASoC: codecs: tas2780: Fix log of failed reset via I2C Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 30/52] s390/kasan: handle DCSS mapping in memory holes Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 31/52] drm/ttm: Reorder sys manager cleanup step Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 32/52] fbdev: omapfb: fix some error codes Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 33/52] fbdev: uvesafb: Call cn_del_callback() at the end of uvesafb_exit() Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 34/52] fbdev: core: cfbcopyarea: fix sloppy typing Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-30  8:39   ` Sergey Shtylyov
2023-10-30  8:39     ` Sergey Shtylyov
2023-11-04  2:07     ` Sasha Levin
2023-11-04  2:07       ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 35/52] fbdev: core: syscopyarea: " Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-30  8:40   ` Sergey Shtylyov
2023-10-30  8:40     ` Sergey Shtylyov
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 36/52] scsi: mpt3sas: Fix in error path Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 37/52] ASoC: da7219: Correct the process of setting up Gnd switch in AAD Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 38/52] drm/amdgpu: Unset context priority is now invalid Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 39/52] gpu/drm: Eliminate DRM_SCHED_PRIORITY_UNSET Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 40/52] LoongArch: Use SYM_CODE_* to annotate exception handlers Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 41/52] LoongArch: Export symbol invalid_pud_table for modules building Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 42/52] LoongArch: Replace kmap_atomic() with kmap_local_page() in copy_user_highpage() Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 43/52] LoongArch: Disable WUC for pgprot_writecombine() like ioremap_wc() Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 44/52] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 45/52] platform/x86: asus-wmi: Only map brightness codes when using asus-wmi backlight control Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 46/52] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 47/52] netfilter: nf_tables: audit log object reset once per table Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 48/52] platform/mellanox: mlxbf-tmfifo: Fix a warning message Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 49/52] nvme-pci: add BOGUS_NID for Intel 0a54 device Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 50/52] Revert "accel/ivpu: Use cached buffers for FW loading" Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 51/52] Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Sasha Levin
2023-10-29 22:53 ` [PATCH AUTOSEL 6.5 52/52] drm/amdgpu: Reserve fences for VM update Sasha Levin
2023-10-29 22:53   ` Sasha Levin
2023-10-29 22:53   ` Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20231029225441.789781-23-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=arkadiusz.bokowy@gmail.com \
    --cc=johan.hedberg@gmail.com \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luiz.dentz@gmail.com \
    --cc=luiz.von.dentz@intel.com \
    --cc=marcel@holtmann.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.