kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/include
History
Luiz Augusto von Dentz 028a68886e Bluetooth: hci_core: Fix sleeping function called from invalid context 
[ Upstream commit 4d94f05558 ]

This reworks hci_cb_list to not use mutex hci_cb_list_lock to avoid bugs
like the bellow:

BUG: sleeping function called from invalid context at kernel/locking/mutex.c:585
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 5070, name: kworker/u9:2
preempt_count: 0, expected: 0
RCU nest depth: 1, expected: 0
4 locks held by kworker/u9:2/5070:
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline]
 #0: ffff888015be3948 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x1770 kernel/workqueue.c:3335
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline]
 #1: ffffc90003b6fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x1770 kernel/workqueue.c:3335
 #2: ffff8880665d0078 (&hdev->lock){+.+.}-{3:3}, at: hci_le_create_big_complete_evt+0xcf/0xae0 net/bluetooth/hci_event.c:6914
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline]
 #3: ffffffff8e132020 (rcu_read_lock){....}-{1:2}, at: hci_le_create_big_complete_evt+0xdb/0xae0 net/bluetooth/hci_event.c:6915
CPU: 0 PID: 5070 Comm: kworker/u9:2 Not tainted 6.8.0-syzkaller-08073-g480e035fc4c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: hci0 hci_rx_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 __might_resched+0x5d4/0x780 kernel/sched/core.c:10187
 __mutex_lock_common kernel/locking/mutex.c:585 [inline]
 __mutex_lock+0xc1/0xd70 kernel/locking/mutex.c:752
 hci_connect_cfm include/net/bluetooth/hci_core.h:2004 [inline]
 hci_le_create_big_complete_evt+0x3d9/0xae0 net/bluetooth/hci_event.c:6939
 hci_event_func net/bluetooth/hci_event.c:7514 [inline]
 hci_event_packet+0xa53/0x1540 net/bluetooth/hci_event.c:7569
 hci_rx_work+0x3e8/0xca0 net/bluetooth/hci_core.c:4171
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
 kthread+0x2f0/0x390 kernel/kthread.c:388
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
 </TASK>

Reported-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
Tested-by: syzbot+2fb0835e0c9cefc34614@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fb0835e0c9cefc34614
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-01-09 13:30:04 +01:00
..
acpi ACPI: CPPC: Make rmw_lock a raw_spin_lock 2024-11-08 16:26:43 +01:00
asm-generic vmlinux.lds.h: catch .bss..L* sections into BSS") 2024-08-03 08:49:02 +02:00
clocksource x86/hyperv: Fix hv tsc page based sched_clock for hibernation 2025-01-09 13:29:56 +01:00
crypto crypto: simd - Do not call crypto_alloc_tfm during registration 2024-10-17 15:21:39 +02:00
drm drm/ttm: Make sure the mapped tt pages are decrypted when needed 2024-12-14 19:54:54 +01:00
dt-bindings dt-bindings: clock: qcom: Add GPLL9 support on gcc-sc8180x 2024-10-17 15:22:07 +02:00
keys certs: Move load_certificate_list() to be with the asymmetric keys code 2022-06-21 16:05:06 +01:00
kunit kunit: add macro to allow conditionally exposing static symbols to tests 2023-11-20 11:52:08 +01:00
kvm KVM: arm64: Fix host-programmed guest events in nVHE 2024-04-10 16:28:23 +02:00
linux af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK 2025-01-09 13:30:02 +01:00
math-emu powerpc/math-emu: Remove -w build flag and fix warnings 2022-09-05 17:28:25 +10:00
media media: v4l2-core: v4l2-dv-timings: check cvt/gtf result 2024-12-14 19:54:04 +01:00
memory memory: renesas-rpc-if: Remove Runtime PM wrappers 2024-12-14 19:53:37 +01:00
misc ocxl: Update the Process Element Entry 2020-12-04 01:01:30 +11:00
net Bluetooth: hci_core: Fix sleeping function called from invalid context 2025-01-09 13:30:04 +01:00
pcmcia ARM: pxa/sa1100: move I/O space to PCI_IOBASE 2022-05-07 22:56:17 +02:00
ras mm, hwpoison: enable memory error handling on 1GB hugepage 2022-08-08 18:06:44 -07:00
rdma RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz 2023-12-13 18:39:15 +01:00
rv Documentation/rv: Add deterministic automata monitor synthesis documentation 2022-07-30 14:01:29 -04:00
scsi scsi: core: Fix the return value of scsi_logical_block_count() 2024-08-29 17:30:49 +02:00
soc net: mscc: ocelot: be resilient to loss of PTP packets during transmission 2024-12-19 18:08:54 +01:00
sound ALSA: dmaengine: Synchronize dma channel after drop() 2024-07-25 09:49:14 +02:00
target scsi: target: Fix multiple LUN_RESET handling 2023-05-11 23:03:19 +09:00
trace tracing/ftrace: disable preemption in syscall probe 2024-12-14 19:54:45 +01:00
uapi stddef: make __struct_group() UAPI C++-friendly 2025-01-02 10:30:51 +01:00
ufs scsi: ufs: core: Make DMA mask configuration more flexible 2024-12-14 19:54:46 +01:00
vdso time64.h: Consolidated PSEC_PER_SEC definition 2021-04-06 16:32:17 -07:00
video video: Provide constants for VGA I/O range 2022-07-19 13:19:11 +02:00
xen xen: simplify evtchn_do_upcall() call maze 2023-12-08 08:51:20 +01:00