Commit a17886b2 authored by Jeffy Chen's avatar Jeffy Chen Committed by Greg Kroah-Hartman

Bluetooth: cmtp: fix possible might sleep error in cmtp_session

commit f06d9773 upstream.

It looks like cmtp_session has same pattern as the issue reported in
old rfcomm:

	while (1) {
		set_current_state(TASK_INTERRUPTIBLE);
		if (condition)
			break;
		// may call might_sleep here
		schedule();
	}
	__set_current_state(TASK_RUNNING);

Which fixed at:
	dfb2fae7 Bluetooth: Fix nested sleeps

So let's fix it at the same way, also follow the suggestion of:
https://lwn.net/Articles/628628/Signed-off-by: default avatarJeffy Chen <jeffy.chen@rock-chips.com>
Reviewed-by: default avatarBrian Norris <briannorris@chromium.org>
Reviewed-by: default avatarAL Yu-Chen Cho <acho@suse.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 81baf8c5
...@@ -280,16 +280,16 @@ static int cmtp_session(void *arg) ...@@ -280,16 +280,16 @@ static int cmtp_session(void *arg)
struct cmtp_session *session = arg; struct cmtp_session *session = arg;
struct sock *sk = session->sock->sk; struct sock *sk = session->sock->sk;
struct sk_buff *skb; struct sk_buff *skb;
wait_queue_t wait; DEFINE_WAIT_FUNC(wait, woken_wake_function);
BT_DBG("session %p", session); BT_DBG("session %p", session);
set_user_nice(current, -15); set_user_nice(current, -15);
init_waitqueue_entry(&wait, current);
add_wait_queue(sk_sleep(sk), &wait); add_wait_queue(sk_sleep(sk), &wait);
while (1) { while (1) {
set_current_state(TASK_INTERRUPTIBLE); /* Ensure session->terminate is updated */
smp_mb__before_atomic();
if (atomic_read(&session->terminate)) if (atomic_read(&session->terminate))
break; break;
...@@ -306,9 +306,8 @@ static int cmtp_session(void *arg) ...@@ -306,9 +306,8 @@ static int cmtp_session(void *arg)
cmtp_process_transmit(session); cmtp_process_transmit(session);
schedule(); wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
} }
__set_current_state(TASK_RUNNING);
remove_wait_queue(sk_sleep(sk), &wait); remove_wait_queue(sk_sleep(sk), &wait);
down_write(&cmtp_session_sem); down_write(&cmtp_session_sem);
...@@ -389,7 +388,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) ...@@ -389,7 +388,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
err = cmtp_attach_device(session); err = cmtp_attach_device(session);
if (err < 0) { if (err < 0) {
atomic_inc(&session->terminate); atomic_inc(&session->terminate);
wake_up_process(session->task); wake_up_interruptible(sk_sleep(session->sock->sk));
up_write(&cmtp_session_sem); up_write(&cmtp_session_sem);
return err; return err;
} }
...@@ -423,7 +422,11 @@ int cmtp_del_connection(struct cmtp_conndel_req *req) ...@@ -423,7 +422,11 @@ int cmtp_del_connection(struct cmtp_conndel_req *req)
/* Stop session thread */ /* Stop session thread */
atomic_inc(&session->terminate); atomic_inc(&session->terminate);
wake_up_process(session->task);
/* Ensure session->terminate is updated */
smp_mb__after_atomic();
wake_up_interruptible(sk_sleep(session->sock->sk));
} else } else
err = -ENOENT; err = -ENOENT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment