[PW_SID:1150937] [v5] Bluetooth: hci_sync: wait for directed advertising completion - #644
[PW_SID:1150937] [v5] Bluetooth: hci_sync: wait for directed advertising completion#644BluezTestBot wants to merge 6 commits into
Conversation
This patch adds workflow files for ci: [sync.yml] - The workflow file for scheduled work - Sync the repo with upstream repo and rebase the workflow branch - Review the patches in the patchwork and creates the PR if needed [ci.yml] - The workflow file for CI tasks - Run CI tests when PR is created Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
This replaces the bzcafe action with bluez/action-ci so we can maintain everything in the github bluez organization Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This attempts to sync every 5 minutes instead of 30. Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
bluez/action-ci uses master as default branch for workflow which is incorrect for kernel Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The CI action now creates individual GitHub Check Runs per test, which requires 'checks: write' permission on the GITHUB_TOKEN. Also make the pull_request trigger types explicit to include 'reopened', allowing CI to be retriggered by closing and reopening a PR.
le_conn_timeout is embedded in struct hci_conn, but queuing the work does
not hold a reference to the connection. hci_conn_del() uses
cancel_delayed_work() because synchronous cancellation would deadlock when
le_conn_timeout() itself calls hci_conn_del() while holding hdev->lock.
This leaves the following interleaving possible:
CPU 0 CPU 1
le_conn_timeout()
hci_conn_del()
cancel_delayed_work() = false
hci_conn_cleanup()
put_device()
kfree(conn)
hci_conn_failed(conn, ...)
The callback then dereferences the released connection. KASAN reported:
BUG: KASAN: slab-use-after-free in hci_conn_failed+0x232/0x250
Read of size 8 at addr ffff8881180e8e20 by task kworker/u33:1/111
Workqueue: hci0 le_conn_timeout
Call Trace:
hci_conn_failed+0x232/0x250
le_conn_timeout+0x23e/0x2c0
process_one_work+0x61b/0xf50
worker_thread+0x45b/0xd10
Remove le_conn_timeout instead of adding another connection reference.
Have the directed-advertising enable commands complete normally, then wait
for the appropriate LE Connection Complete event with HCI_OP_NOP, matching
other Command Complete then later-event sequences such as PAST. The
command-sync entry already holds a connection reference until its
completion callback returns.
LE Set Advertising Enable and LE Set Extended Advertising Enable return
Command Complete rather than Command Status, so the later event cannot be
attached to the enable command itself without changing generic command
completion. Waiting with HCI_OP_NOP keeps that completion path unchanged.
Mark directed advertising as an in-flight connection attempt so teardown
can cancel the wait. Disable advertising synchronously when that wait
fails, and preserve HCI_ERROR_ADVERTISING_TIMEOUT for a software timeout.
Clear the instance-0 extended advertising state when advertising is stopped
or a connection completes so resuming paused advertising does not restart
the directed advertising instance.
There is then no delayed callback that can race with connection deletion.
Fixes: 980ffc0 ("Bluetooth: Fix LE connection timeout deadlock")
Cc: stable@vger.kernel.org
Suggested-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
|
CheckPatch |
|
VerifyFixes |
|
VerifySignedoff |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
CheckKernelLLVM |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
TestRunner_6lowpan-tester |
|
IncrementalBuild |
5774a29 to
616126a
Compare
4 participants
le_conn_timeout is embedded in struct hci_conn, but queuing the work does
not hold a reference to the connection. hci_conn_del() uses
cancel_delayed_work() because synchronous cancellation would deadlock when
le_conn_timeout() itself calls hci_conn_del() while holding hdev->lock.
This leaves the following interleaving possible:
CPU 0 CPU 1
le_conn_timeout()
hci_conn_del()
cancel_delayed_work() = false
hci_conn_cleanup()
put_device()
kfree(conn)
hci_conn_failed(conn, ...)
The callback then dereferences the released connection. KASAN reported:
BUG: KASAN: slab-use-after-free in hci_conn_failed+0x232/0x250
Read of size 8 at addr ffff8881180e8e20 by task kworker/u33:1/111
Workqueue: hci0 le_conn_timeout
Call Trace:
hci_conn_failed+0x232/0x250
le_conn_timeout+0x23e/0x2c0
process_one_work+0x61b/0xf50
worker_thread+0x45b/0xd10
Remove le_conn_timeout instead of adding another connection reference.
Have the directed-advertising enable commands complete normally, then wait
for the appropriate LE Connection Complete event with HCI_OP_NOP, matching
other Command Complete then later-event sequences such as PAST. The
command-sync entry already holds a connection reference until its
completion callback returns.
LE Set Advertising Enable and LE Set Extended Advertising Enable return
Command Complete rather than Command Status, so the later event cannot be
attached to the enable command itself without changing generic command
completion. Waiting with HCI_OP_NOP keeps that completion path unchanged.
Mark directed advertising as an in-flight connection attempt so teardown
can cancel the wait. Disable advertising synchronously when that wait
fails, and preserve HCI_ERROR_ADVERTISING_TIMEOUT for a software timeout.
Clear the instance-0 extended advertising state when advertising is stopped
or a connection completes so resuming paused advertising does not restart
the directed advertising instance.
There is then no delayed callback that can race with connection deletion.
Fixes: 980ffc0 ("Bluetooth: Fix LE connection timeout deadlock")
Cc: stable@vger.kernel.org
Suggested-by: Luiz Augusto von Dentz luiz.dentz@gmail.com
Signed-off-by: Chengfeng Ye nicoyip.dev@gmail.com
Changes in v5:
request pending on successful Command Complete when a later event was
requested broke BlueZ CI PAST, Read Exp Feature, and Mesh Send cancel.
enable command completes, matching PAST, instead of changing generic
command-complete semantics.
Changes in v4:
Bluetooth CI HEAD.
Changes in v3:
the caller requested a later event, matching the existing Command Status
behavior and fixing the first Sashiko/Luiz report.
and when LE connection complete implicitly stops advertising, fixing the
second Sashiko report about resuming stale directed advertising.
Changes in v2:
Link: https://lore.kernel.org/linux-bluetooth/20260821172441.3020751-1-nicoyip.dev@gmail.com/ [v4]
Link: https://lore.kernel.org/linux-bluetooth/20260821164512.2842464-1-nicoyip.dev@gmail.com/ [v3]
Link: https://lore.kernel.org/linux-bluetooth/20260801145430.3560911-1-nicoyip.dev@gmail.com/ [v2]
Link: https://lore.kernel.org/linux-bluetooth/20260730104103.2080325-1-nicoyip.dev@gmail.com/ [v1]
Link: https://sashiko.dev/#/patchset/20260801145430.3560911-1-nicoyip.dev%40gmail.com
include/net/bluetooth/hci_core.h | 1 -
net/bluetooth/hci_conn.c | 45 --------------------------------
net/bluetooth/hci_event.c | 33 +++++------------------
net/bluetooth/hci_sync.c | 38 ++++++++++++++++++++++-----
4 files changed, 38 insertions(+), 79 deletions(-)