Bluetooth: avoid recursive locking in hci_send_to_channel()

Mart reported a deadlock in -RT in the call path:
  hci_send_monitor_ctrl_event() -> hci_send_to_channel()

because both functions acquire the same read lock hci_sk_list.lock. This
is also a mainline issue because the qrwlock implementation is writer
fair (the traditional rwlock implementation is reader biased).

To avoid the deadlock there is now __hci_send_to_channel() which expects
the readlock to be held.

Fixes: 38ceaa00d02d ("Bluetooth: Add support for sending MGMT commands and events to monitor")
Reported-by: Mart van de Wege <mvdwege@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 65d734c165bd6368b8607d0b5078d345b5e642a8..923e9a27187205e5ea6f07103a87b71e7c48e262 100644 (file)
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -251,15 +251,13 @@ void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 }
 
 /* Send frame to sockets with specific channel */
-void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
-                        int flag, struct sock *skip_sk)
+static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
+                                 int flag, struct sock *skip_sk)
 {
        struct sock *sk;
 
        BT_DBG("channel %u len %d", channel, skb->len);
 
-       read_lock(&hci_sk_list.lock);
-
        sk_for_each(sk, &hci_sk_list.head) {
                struct sk_buff *nskb;
 
@@ -285,6 +283,13 @@ void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
                        kfree_skb(nskb);
        }
 
+}
+
+void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
+                        int flag, struct sock *skip_sk)
+{
+       read_lock(&hci_sk_list.lock);
+       __hci_send_to_channel(channel, skb, flag, skip_sk);
        read_unlock(&hci_sk_list.lock);
 }
 
@@ -388,8 +393,8 @@ void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event,
                hdr->index = index;
                hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 
-               hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
-                                   HCI_SOCK_TRUSTED, NULL);
+               __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
+                                     HCI_SOCK_TRUSTED, NULL);
                kfree_skb(skb);
        }