lkml.org 
[lkml]   [2023]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 6.5 23/52] Bluetooth: vhci: Fix race when opening vhci device
    Date
    From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>

    [ Upstream commit 92d4abd66f7080075793970fc8f241239e58a9e7 ]

    When the vhci device is opened in the two-step way, i.e.: open device
    then write a vendor packet with requested controller type, the device
    shall respond with a vendor packet which includes HCI index of created
    interface.

    When the virtual HCI is created, the host sends a reset request to the
    controller. This request is processed by the vhci_send_frame() function.
    However, this request is send by a different thread, so it might happen
    that this HCI request will be received before the vendor response is
    queued in the read queue. This results in the HCI vendor response and
    HCI reset request inversion in the read queue which leads to improper
    behavior of btvirt:

    > dmesg
    [1754256.640122] Bluetooth: MGMT ver 1.22
    [1754263.023806] Bluetooth: MGMT ver 1.22
    [1754265.043775] Bluetooth: hci1: Opcode 0x c03 failed: -110

    In order to synchronize vhci two-step open/setup process with virtual
    HCI initialization, this patch adds internal lock when queuing data in
    the vhci_send_frame() function.

    Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/bluetooth/hci_vhci.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
    index 40e2b9fa11a26..f3892e9ce800f 100644
    --- a/drivers/bluetooth/hci_vhci.c
    +++ b/drivers/bluetooth/hci_vhci.c
    @@ -74,7 +74,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
    struct vhci_data *data = hci_get_drvdata(hdev);

    memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
    +
    + mutex_lock(&data->open_mutex);
    skb_queue_tail(&data->readq, skb);
    + mutex_unlock(&data->open_mutex);

    wake_up_interruptible(&data->read_wait);
    return 0;
    --
    2.42.0
    \
     
     \ /
      Last update: 2023-10-29 23:57    [W:3.017 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site