From patchwork Thu Nov 24 14:15:59 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: tip-bot2 for Thomas Gleixner X-Patchwork-Id: 25566 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp3426102wrr; Thu, 24 Nov 2022 06:21:36 -0800 (PST) X-Google-Smtp-Source: AA0mqf6BO7qk9VvptUKt/6u7JiStonG4pCoOflF1K+Wa27F59JrUc6JVlfY3qCiM5/nj5W50iIWF X-Received: by 2002:a63:5c1e:0:b0:46e:96ba:494d with SMTP id q30-20020a635c1e000000b0046e96ba494dmr12283700pgb.404.1669299696102; Thu, 24 Nov 2022 06:21:36 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669299696; cv=none; d=google.com; s=arc-20160816; b=bgj8Bf14qOlm3O3cO1Q+ZUIlsH0YqtOtCGhFPfBsImMQqDH+cZ7Y0aF+6XPk20JYl/ 4cWXkLs5f1nU9KGtQTEWhJ9JAZsN1/sj1mZWS4zHMA6nasql9e3yQLQWfs4yDtkx9gY3 DIhtuUV6i4i4K1/MIDpeqJn8boSmVjL42ypyKRqyNc1uRQUfH/DZ/laERZAFhk8a8QQ6 d6+tQzFGeCgCANbJIHnbN31LrP6L0ddUGLvjaZm7M6Fy7NpbNN7tlirasDDVxg8ljmw+ EEo5k7TlL09XB2ul8sJFjLNX/vefk8RDHRwxvpITiJ8IZ3YuRw5Z1mPmtiRThGSkTXK4 HEDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:robot-unsubscribe :robot-id:message-id:mime-version:references:in-reply-to:cc:subject :to:reply-to:sender:from:dkim-signature:dkim-signature:date; bh=bWI0UEhQr9VQ7aatrwtP6TrToC5Bs+6i/FVI2Mff5kE=; b=zlbxnvdvzNRVRmqNRmEn7mP6J2vzaf+fox0l7TxC15nTi85+pbvpGGLoPW1bPI/7JV jfQDTftLlT2ucBBEGzK/ebQEwwOgXb0EulkXDBy7Fx7ai6oKoKUcxAkxjcBAdA7EhamA N8Wt7Y1DSR9xiKINTglRpMN1JsPjGfOLXRxayxSXpBNgMF09Du9upowiYT6wEsVZ6v8f P8mTAUL8Jc3L4Hm6IJ4PX4+j4rOvWLeKtTQLMvmGFsQOgjAs6HuMfRfXmhA+tQ1rCu/k ySjdDSX4QgfSzLH0lvUkL6HV3pGk3AcNMdtzQdgrli4c4zlE+086gNoG0prdnFKD+xM+ kSXw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=DhR9B8jU; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s11-20020a65584b000000b0047712cb3fe3si1369474pgr.590.2022.11.24.06.21.22; Thu, 24 Nov 2022 06:21:36 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linutronix.de header.s=2020 header.b=DhR9B8jU; dkim=neutral (no key) header.i=@linutronix.de header.s=2020e; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=linutronix.de Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230150AbiKXOQL (ORCPT + 99 others); Thu, 24 Nov 2022 09:16:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229909AbiKXOQF (ORCPT ); Thu, 24 Nov 2022 09:16:05 -0500 Received: from galois.linutronix.de (Galois.linutronix.de [IPv6:2a0a:51c0:0:12e:550::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3CFD7EA128; Thu, 24 Nov 2022 06:16:02 -0800 (PST) Date: Thu, 24 Nov 2022 14:15:59 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1669299360; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bWI0UEhQr9VQ7aatrwtP6TrToC5Bs+6i/FVI2Mff5kE=; b=DhR9B8jUKznbXaDBQTm0OHPUXlpK6L+Ej9VzjHJed0pme8qNXUL8+XTEm6FytQO5oR+lTa 2NTTT5rHFAdLR4CrS2QdLPKV+kiUkeVTD8WYtGbyORuUn+3p6GCIuC7A0WtnadsM2yiNmc OWaEEWciGV/po+wPVgV8GKoQ30JyqoD6RSHWHHebOO3XG+2hJUm7n/ebThZ325ha+n9l70 sn86kJJSKc/CoOfCklutLToUshDT895/oK4q+PGUvXFPm57vFI1Ob7WbNrg5PDjDZXOqd0 Nmb6taBTa3hqr41KzaZZSARW0tDI1xonYfKBnEwTmsP/3iliB4vUCbwPbsUs+A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1669299360; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=bWI0UEhQr9VQ7aatrwtP6TrToC5Bs+6i/FVI2Mff5kE=; b=TQJII8tm8RnSBAToW8GjHwtu3pfb8Q17DPar0Chqmp5h2syVjbw416y6pfLP05D2K5t3M4 1ooPmhan967f1mCw== From: "tip-bot2 for Thomas Gleixner" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: timers/core] Bluetooth: hci_qca: Fix the teardown problem for real Cc: Thomas Gleixner , Guenter Roeck , Jacob Keller , "Anna-Maria Behnsen" , Luiz Augusto von Dentz , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <87iljhsftt.ffs@tglx> References: <87iljhsftt.ffs@tglx> MIME-Version: 1.0 Message-ID: <166929935911.4906.958262120694273735.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails X-Spam-Status: No, score=-4.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED,SPF_HELO_NONE, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750387597900318585?= X-GMAIL-MSGID: =?utf-8?q?1750387597900318585?= The following commit has been merged into the timers/core branch of tip: Commit-ID: e0d3da982c96aeddc1bbf1cf9469dbb9ebdca657 Gitweb: https://git.kernel.org/tip/e0d3da982c96aeddc1bbf1cf9469dbb9ebdca657 Author: Thomas Gleixner AuthorDate: Wed, 23 Nov 2022 21:18:57 +01:00 Committer: Thomas Gleixner CommitterDate: Thu, 24 Nov 2022 15:09:12 +01:00 Bluetooth: hci_qca: Fix the teardown problem for real While discussing solutions for the teardown problem which results from circular dependencies between timers and workqueues, where timers schedule work from their timer callback and workqueues arm the timers from work items, it was discovered that the recent fix to the QCA code is incorrect. That commit fixes the obvious problem of using del_timer() instead of del_timer_sync() and reorders the teardown calls to destroy_workqueue(wq); del_timer_sync(t); This makes it less likely to explode, but it's still broken: destroy_workqueue(wq); /* After this point @wq cannot be touched anymore */ ---> timer expires queue_work(wq) <---- Results in a NULL pointer dereference deep in the work queue core code. del_timer_sync(t); Use the new timer_shutdown_sync() function to ensure that the timers are disarmed, no timer callbacks are running and the timers cannot be armed again. This restores the original teardown sequence: timer_shutdown_sync(t); destroy_workqueue(wq); which is now correct because the timer core silently ignores potential rearming attempts which can happen when destroy_workqueue() drains pending work before mopping up the workqueue. Fixes: 72ef98445aca ("Bluetooth: hci_qca: Use del_timer_sync() before freeing") Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: Jacob Keller Reviewed-by: Anna-Maria Behnsen Acked-by: Luiz Augusto von Dentz Link: https://lore.kernel.org/all/87iljhsftt.ffs@tglx Link: https://lore.kernel.org/r/20221123201625.435907114@linutronix.de --- drivers/bluetooth/hci_qca.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c index 8df1101..ba8be8e 100644 --- a/drivers/bluetooth/hci_qca.c +++ b/drivers/bluetooth/hci_qca.c @@ -696,9 +696,15 @@ static int qca_close(struct hci_uart *hu) skb_queue_purge(&qca->tx_wait_q); skb_queue_purge(&qca->txq); skb_queue_purge(&qca->rx_memdump_q); + /* + * Shut the timers down so they can't be rearmed when + * destroy_workqueue() drains pending work which in turn might try + * to arm a timer. After shutdown rearm attempts are silently + * ignored by the timer core code. + */ + timer_shutdown_sync(&qca->tx_idle_timer); + timer_shutdown_sync(&qca->wake_retrans_timer); destroy_workqueue(qca->workqueue); - del_timer_sync(&qca->tx_idle_timer); - del_timer_sync(&qca->wake_retrans_timer); qca->hu = NULL; kfree_skb(qca->rx_skb);