Messages in this thread Patch in this message | | | Subject | Re: [syzbot] BUG: sleeping function called from invalid context in hci_cmd_sync_cancel | From | Oliver Neukum <> | Date | Thu, 9 Dec 2021 11:06:50 +0100 |
| |
On 09.12.21 02:59, syzbot wrote: > syzbot has bisected this issue to: > > commit c97a747efc93f94a4ad6c707972dfbf8d774edf9 > Author: Benjamin Berg <bberg@redhat.com> > Date: Fri Dec 3 14:59:02 2021 +0000 > > Bluetooth: btusb: Cancel sync commands for certain URB errors
Hi,
looking at the patch, it sleeps in an interrupt handler (or equivalent) in two places:
@@ -933,6 +933,8 @@ static void btusb_intr_complete(struct urb *urb) if (err != -EPERM && err != -ENODEV) bt_dev_err(hdev, "urb %p failed to resubmit (%d)", urb, -err); + if (err != -EPERM) + hci_cmd_sync_cancel(hdev, -err);
@@ -1331,10 +1335,13 @@ static void btusb_tx_complete(struct urb *urb) if (!test_bit(HCI_RUNNING, &hdev->flags)) goto done; - if (!urb->status) + if (!urb->status) { hdev->stat.byte_tx += urb->transfer_buffer_length; - else + } else { + if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) + hci_cmd_sync_cancel(hdev, -urb->status);
As __cancel_work_timer can be called from hci_cmd_sync_cancel() this is just not an approach you can take. It looks like asynchronously canceling the scheduled work would result in a race, so I would for now just revert.
What issue exactly is this trying to fix or improve?
Regards Oliver
| |