linux.git/net/bluetooth/rfcomm, branch v2.6.36

Bluetooth: Fix inconsistent lock state with RFCOMM

2010-09-30T15:19:35+00:00

When receiving a rfcomm connection with the old dund deamon a
inconsistent lock state happens. That's because interrupts were already
disabled by l2cap_conn_start() when rfcomm_sk_state_change() try to lock
the spin_lock.

As result we may have a inconsistent lock state for l2cap_conn_start()
after rfcomm_sk_state_change() calls bh_lock_sock() and disable interrupts
as well.

[ 2833.151999]
[ 2833.151999] =================================
[ 2833.151999] [ INFO: inconsistent lock state ]
[ 2833.151999] 2.6.36-rc3 #2
[ 2833.151999] ---------------------------------
[ 2833.151999] inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
[ 2833.151999] krfcommd/2306 [HC0[0]:SC0[0]:HE1:SE1] takes:
[ 2833.151999]  (slock-AF_BLUETOOTH){+.?...}, at: [] rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999] {IN-SOFTIRQ-W} state was registered at:
[ 2833.151999]   [] __lock_acquire+0x5b6/0x1560
[ 2833.151999]   [] lock_acquire+0x5a/0x70
[ 2833.151999]   [] _raw_spin_lock+0x2c/0x40
[ 2833.151999]   [] l2cap_conn_start+0x92/0x640 [l2cap]
[ 2833.151999]   [] l2cap_sig_channel+0x6bf/0x1320 [l2cap]
[ 2833.151999]   [] l2cap_recv_frame+0x133/0x770 [l2cap]
[ 2833.151999]   [] l2cap_recv_acldata+0x1cb/0x390 [l2cap]
[ 2833.151999]   [] hci_rx_task+0x2ab/0x450 [bluetooth]
[ 2833.151999]   [] tasklet_action+0xcb/0xe0
[ 2833.151999]   [] __do_softirq+0xae/0x150
[ 2833.151999]   [] call_softirq+0x1c/0x30
[ 2833.151999]   [] do_softirq+0x75/0xb0
[ 2833.151999]   [] irq_exit+0x8d/0xa0
[ 2833.151999]   [] smp_apic_timer_interrupt+0x6b/0xa0
[ 2833.151999]   [] apic_timer_interrupt+0x13/0x20
[ 2833.151999]   [] cpu_idle+0x5a/0xb0
[ 2833.151999]   [] rest_init+0xad/0xc0
[ 2833.151999]   [] start_kernel+0x2dd/0x2e8
[ 2833.151999]   [] x86_64_start_reservations+0xf6/0xfa
[ 2833.151999]   [] x86_64_start_kernel+0xe4/0xeb
[ 2833.151999] irq event stamp: 731
[ 2833.151999] hardirqs last  enabled at (731): [] local_bh_enable_ip+0x82/0xe0
[ 2833.151999] hardirqs last disabled at (729): [] __do_softirq+0xce/0x150
[ 2833.151999] softirqs last  enabled at (730): [] __do_softirq+0xfe/0x150
[ 2833.151999] softirqs last disabled at (711): [] call_softirq+0x1c/0x30
[ 2833.151999]
[ 2833.151999] other info that might help us debug this:
[ 2833.151999] 2 locks held by krfcommd/2306:
[ 2833.151999]  #0:  (rfcomm_mutex){+.+.+.}, at: [] rfcomm_run+0x174/0xb20 [rfcomm]
[ 2833.151999]  #1:  (&(&d->lock)->rlock){+.+...}, at: [] rfcomm_dlc_accept+0x53/0x100 [rfcomm]
[ 2833.151999]
[ 2833.151999] stack backtrace:
[ 2833.151999] Pid: 2306, comm: krfcommd Tainted: G        W   2.6.36-rc3 #2
[ 2833.151999] Call Trace:
[ 2833.151999]  [] print_usage_bug+0x171/0x180
[ 2833.151999]  [] mark_lock+0x333/0x400
[ 2833.151999]  [] __lock_acquire+0x63a/0x1560
[ 2833.151999]  [] ? __lock_acquire+0xb25/0x1560
[ 2833.151999]  [] lock_acquire+0x5a/0x70
[ 2833.151999]  [] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999]  [] _raw_spin_lock+0x2c/0x40
[ 2833.151999]  [] ? rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999]  [] rfcomm_sk_state_change+0x46/0x170 [rfcomm]
[ 2833.151999]  [] rfcomm_dlc_accept+0x69/0x100 [rfcomm]
[ 2833.151999]  [] rfcomm_check_accept+0x59/0xd0 [rfcomm]
[ 2833.151999]  [] rfcomm_recv_frame+0x9fb/0x1320 [rfcomm]
[ 2833.151999]  [] ? _raw_spin_unlock_irqrestore+0x3b/0x60
[ 2833.151999]  [] ? trace_hardirqs_on_caller+0x13d/0x180
[ 2833.151999]  [] ? trace_hardirqs_on+0xd/0x10
[ 2833.151999]  [] rfcomm_run+0x221/0xb20 [rfcomm]
[ 2833.151999]  [] ? schedule+0x287/0x780
[ 2833.151999]  [] ? rfcomm_run+0x0/0xb20 [rfcomm]
[ 2833.151999]  [] kthread+0x96/0xa0
[ 2833.151999]  [] kernel_thread_helper+0x4/0x10
[ 2833.151999]  [] ? restore_args+0x0/0x30
[ 2833.151999]  [] ? kthread+0x0/0xa0
[ 2833.151999]  [] ? kernel_thread_helper+0x0/0x10

Signed-off-by: Gustavo F. Padovan

Bluetooth: Remove __exit from rfcomm_cleanup_ttys()

2010-07-31T23:09:21+00:00

rfcomm_cleanup_ttys() is also called from rfcomm_init(), so it can't
have __exit.

Reported-by: Mat Martineau 
Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

Bluetooth: Add init and exit marks to RFCOMM

2010-07-27T19:37:27+00:00

Those annotation save memory and space on the binary. __init code is
discarded just after execute and __exit code is discarded if the module
is built into the kernel image or unload of modules is not allowed.

Signed-off-by: Gustavo F. Padovan 
Signed-off-by: Marcel Holtmann

net: Remove unnecessary returns from void function()s

2010-05-18T06:23:14+00:00

This patch removes from net/ (but not any netfilter files)
all the unnecessary return; statements that precede the
last closing brace of void functions.

It does not remove the returns that are immediately
preceded by a label as gcc doesn't like that.

Done via:
$ grep -rP --include=*.[ch] -l "return;\n}" net/ | \
  xargs perl -i -e 'local $/ ; while (<>) { s/\n[ \t\n]+return;\n}/\n}/g; print; }'

Signed-off-by: Joe Perches 
Signed-off-by: David S. Miller

net: sk_sleep() helper

2010-04-20T23:37:13+00:00

Define a new function to return the waitqueue of a "struct sock".

static inline wait_queue_head_t *sk_sleep(struct sock *sk)
{
	return sk->sk_sleep;
}

Change all read occurrences of sk_sleep by a call to this function.

Needed for a future RCU conversion. sk_sleep wont be a field directly
available.

Signed-off-by: Eric Dumazet 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

2010-04-06T15:34:06+00:00

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (37 commits)
  smc91c92_cs: fix the problem of "Unable to find hardware address"
  r8169: clean up my printk uglyness
  net: Hook up cxgb4 to Kconfig and Makefile
  cxgb4: Add main driver file and driver Makefile
  cxgb4: Add remaining driver headers and L2T management
  cxgb4: Add packet queues and packet DMA code
  cxgb4: Add HW and FW support code
  cxgb4: Add register, message, and FW definitions
  netlabel: Fix several rcu_dereference() calls used without RCU read locks
  bonding: fix potential deadlock in bond_uninit()
  net: check the length of the socket address passed to connect(2)
  stmmac: add documentation for the driver.
  stmmac: fix kconfig for crc32 build error
  be2net: fix bug in vlan rx path for big endian architecture
  be2net: fix flashing on big endian architectures
  be2net: fix a bug in flashing the redboot section
  bonding: bond_xmit_roundrobin() fix
  drivers/net: Add missing unlock
  net: gianfar - align BD ring size console messages
  net: gianfar - initialize per-queue statistics
  ...

net: check the length of the socket address passed to connect(2)

2010-04-02T00:26:01+00:00

check the length of the socket address passed to connect(2).

Check the length of the socket address passed to connect(2). If the
length is invalid, -EINVAL will be returned.

Signed-off-by: Changli Gao 
----
net/bluetooth/l2cap.c | 3 ++-
net/bluetooth/rfcomm/sock.c | 3 ++-
net/bluetooth/sco.c | 3 ++-
net/can/bcm.c | 3 +++
net/ieee802154/af_ieee802154.c | 3 +++
net/ipv4/af_inet.c | 5 +++++
net/netlink/af_netlink.c | 3 +++
7 files changed, 20 insertions(+), 3 deletions(-)
Signed-off-by: David S. Miller

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30T13:02:32+00:00

percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files.  percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.

percpu.h -> slab.h dependency is about to be removed.  Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability.  As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.

  http://userweb.kernel.org/~tj/misc/slabh-sweep.py

The script does the followings.

* Scan files for gfp and slab usages and update includes such that
  only the necessary includes are there.  ie. if only gfp is used,
  gfp.h, if slab is used, slab.h.

* When the script inserts a new include, it looks at the include
  blocks and try to put the new include such that its order conforms
  to its surrounding.  It's put in the include block which contains
  core kernel includes, in the same order that the rest are ordered -
  alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
  doesn't seem to be any matching order.

* If the script can't find a place to put a new include (mostly
  because the file doesn't have fitting include block), it prints out
  an error message indicating which .h file needs to be added to the
  file.

The conversion was done in the following steps.

1. The initial automatic conversion of all .c files updated slightly
   over 4000 files, deleting around 700 includes and adding ~480 gfp.h
   and ~3000 slab.h inclusions.  The script emitted errors for ~400
   files.

2. Each error was manually checked.  Some didn't need the inclusion,
   some needed manual addition while adding it to implementation .h or
   embedding .c file was more appropriate for others.  This step added
   inclusions to around 150 files.

3. The script was run again and the output was compared to the edits
   from #2 to make sure no file was left behind.

4. Several build tests were done and a couple of problems were fixed.
   e.g. lib/decompress_*.c used malloc/free() wrappers around slab
   APIs requiring slab.h to be added manually.

5. The script was run on all .h files but without automatically
   editing them as sprinkling gfp.h and slab.h inclusions around .h
   files could easily lead to inclusion dependency hell.  Most gfp.h
   inclusion directives were ignored as stuff from gfp.h was usually
   wildly available and often used in preprocessor macros.  Each
   slab.h inclusion directive was examined and added manually as
   necessary.

6. percpu.h was updated not to include slab.h.

7. Build test were done on the following configurations and failures
   were fixed.  CONFIG_GCOV_KERNEL was turned off for all tests (as my
   distributed build env didn't work with gcov compiles) and a few
   more options had to be turned off depending on archs to make things
   build (like ipr on powerpc/64 which failed due to missing writeq).

   * x86 and x86_64 UP and SMP allmodconfig and a custom test config.
   * powerpc and powerpc64 SMP allmodconfig
   * sparc and sparc64 SMP allmodconfig
   * ia64 SMP allmodconfig
   * s390 SMP allmodconfig
   * alpha SMP allmodconfig
   * um on x86_64 SMP allmodconfig

8. percpu.h modifications were reverted so that it could be applied as
   a separate patch and serve as bisection point.

Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.

Signed-off-by: Tejun Heo 
Guess-its-ok-by: Christoph Lameter 
Cc: Ingo Molnar 
Cc: Lee Schermerhorn

Bluetooth: Convert debug files to actually use debugfs instead of sysfs

2010-03-21T04:49:35+00:00

Some of the debug files ended up wrongly in sysfs, because at that point
of time, debugfs didn't exist. Convert these files to use debugfs and
also seq_file. This patch converts all of these files at once and then
removes the exported symbol for the Bluetooth sysfs class.

Signed-off-by: Marcel Holtmann

Bluetooth: Fix potential bad memory access with sysfs files

2010-03-21T04:49:32+00:00

When creating a high number of Bluetooth sockets (L2CAP, SCO
and RFCOMM) it is possible to scribble repeatedly on arbitrary
pages of memory. Ensure that the content of these sysfs files is
always less than one page. Even if this means truncating. The
files in question are scheduled to be moved over to debugfs in
the future anyway.

Based on initial patches from Neil Brown and Linus Torvalds

Reported-by: Neil Brown 
Signed-off-by: Marcel Holtmann