Subject: Re: [syzbot] BUG: sleeping function called from invalid context in
 hci_cmd_sync_cancel
To:     Benjamin Berg <bberg@redhat.com>, Oliver Neukum <oneukum@suse.com>,
        syzbot <syzbot+485cc00ea7cf41dfdbf1@syzkaller.appspotmail.com>,
        Thinh.Nguyen@synopsys.com, changbin.du@intel.com,
        christian.brauner@ubuntu.com, davem@davemloft.net,
        edumazet@google.com, gregkh@linuxfoundation.org,
        johan.hedberg@gmail.com, kuba@kernel.org,
        linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-usb@vger.kernel.org, luiz.dentz@gmail.com,
        luiz.von.dentz@intel.com, marcel@holtmann.org,
        mathias.nyman@linux.intel.com, netdev@vger.kernel.org,
        stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com,
        yajun.deng@linux.dev
References: <00000000000098464c05d2acf3ba@google.com>
 <3e8cba55-5d34-eab3-0625-687b66bb9449@suse.com>
 <14584c1a1e449cc20b5af7918b411ee27cf1570b.camel@redhat.com>
From:   Oliver Neukum <oneukum@suse.com>
Message-ID: <f47f6972-b977-aae8-dd4d-44d85db2e8a4@suse.com>
Date:   Thu, 9 Dec 2021 14:21:20 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.12.0
In-Reply-To: <14584c1a1e449cc20b5af7918b411ee27cf1570b.camel@redhat.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Content-Language: en-US
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?eIoaYPLrjZwoIy2zZG0u0qEIwKkamA2HownzlR6DC5tnQWXrtULZWS6/5UGH?=
 =?us-ascii?Q?Mrdzoe25NGXCNy97oWhszJUmbcEGBoLQenTwWxex5aMPrWOLsJ+uWsCCCGQ8?=
 =?us-ascii?Q?/+qKzwORbJepMMAQCOjQ5ghTQsMy+KeCB985EpK5X/VNfLc3q47psLWTtnsY?=
 =?us-ascii?Q?mB7v2fUf7PmCHCrzVc2orSwI4NPBWhZlX8Nwce/QrSR8V7uO+zHA2JR4bbMm?=
 =?us-ascii?Q?JMj9EtKgtHBUqEKYq8Zev/Kgar1nWdNtMWo2S9nXWK+kh/cwdsX6SMNJITNr?=
 =?us-ascii?Q?TovYM5VUOrVFyGU1khTxTbeyMyDV19eoY7dm2QBr5mMVezyH+71CeyTqL2uv?=
 =?us-ascii?Q?yKeZoH0aHXc1k4Vq9U0MTiMREEcFcXBHpO27+ksHA2W86KgMrMSdOHxCf+yR?=
 =?us-ascii?Q?r/Uorw1w0HuQtxHmwCSrOHj/yeSKW9aD81neTXz5vdw7wKFmMG+WylCkg1PZ?=
 =?us-ascii?Q?IW8DDxiaUkvW+49aOTxdbPqWXJDyXpCOLZuqvWQTsJnUtm+Sj5lFx2Jlb+47?=
 =?us-ascii?Q?i748JiJq9CMEHiY9y7FjuL4W0t/47k1D0EVgcvgQWDOIZ0LsSrDeqwfwQO8G?=
 =?us-ascii?Q?fWmETxRWcdo4uNIuE3M67tWhJlfuNaeupeI0cJ4hSC/7OukaNT6kUGf/RhPz?=
 =?us-ascii?Q?HMS+oTxtzrVvBe9GwEA61YVoB+0nbBlie2i/YImKmzvugIN6/DbgeNLMD2r1?=
 =?us-ascii?Q?wGyAMkJGR1LyxySJ3UoXM7QyCzhypPFYXdjdHicKuzxxbP6hkwVQSZLG2LF5?=
 =?us-ascii?Q?7Bmgl/aHpir4HeAjA2CmjVUL+y4/9JoAYxXKnuT0uu4dQivSgmsvgmxOvtdz?=
 =?us-ascii?Q?2U9DQh1MjC4G6o8Ae2kE66ai3bwtrVNX10tyC2LHJ5WekZ2kVD7O8PSz9hFK?=
 =?us-ascii?Q?SuE2We8st9vAcwe8rElhZ90Rj85ONMsQ5MMkCfmZd69KxkK19KvQiEkLOrJo?=
 =?us-ascii?Q?RrLDY1P7lEyquJAjZ9bBZ54BO4QtNHYvhFD8/zFJjCVPdNk+7izPyTAO+pBC?=
 =?us-ascii?Q?sIZqsj41LEJQJRx8k0K0HCKgXcqXStA6yIKOKpCWaoaB180GdfiJEuGpPmvr?=
 =?us-ascii?Q?h/rwcvj+C8dYZ3I6mfnSK8SXgv+/NpDu0+rK5bkn8UTZCV1u+7ErG5sFZDdg?=
 =?us-ascii?Q?6eonK1AAZZQPchVnsioUMkrQFhbOGOkjYMq2Q7NEElvdBt1NghUXN7PVkQIo?=
 =?us-ascii?Q?u6xjjLo7vrOTB0wkKmSXdoilXYsUVJk6XengSWrxmAmTBzetFobOLgRcJ+pc?=
 =?us-ascii?Q?0nFraLZ1XR1xE9h3OleeZpLvzscz9pEgUr7wowWNGCkI4VD9pbAg9DLC8YIt?=
 =?us-ascii?Q?Oa6dbQcnA10tXky9ATNsvHSa52ToYe+YA6uuHhtvVh7FrztbbJGEPnTUVxRj?=
 =?us-ascii?Q?am6QD8iEwEsVvtATwJrIXnW/AR3x/x3hMVVc39Py2PZiYoTePzsiZ1cwvlCb?=
 =?us-ascii?Q?HI/HIfQVXxFcvlSLN70kwDxV9KeHMPrUERIeoFJUQ4jirU5D1VS2czjS5a4p?=
 =?us-ascii?Q?gtV/aJlgf0ZTOdz0FKS7IfteClTcfLEA/gTGXIeXsOXQQCGPy0FrZ1DVlUks?=
 =?us-ascii?Q?bQf7XOt1QWzZUlaqSAC2s7cXPZR8NzYve3E/gkuv9Df1eIoh+miMBh9QI8Es?=
 =?us-ascii?Q?5eNeLq+yfMfZCN1u5d9eJqw9TcUGBOjFAg1vrJyx/1DLmXUhbJaUjKQykjff?=
 =?us-ascii?Q?/WPC/3WBEpUe9sH6NMZt33jjWgk=3D?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 4f68ea42-e28b-448b-a420-08d9bb16cbe6
X-MS-Exchange-CrossTenant-AuthSource: DB7PR04MB5050.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Dec 2021 13:21:23.5789
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: /+eyHZ3j43Q0ckLzkLAu2uo2kw40/8pJJpvlvHBzMli/eloMwpdMGFKidASXypt6DO+fTY2MIWgoAFoHt0x6vA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR04MB4139
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


On 09.12.21 13:46, Benjamin Berg wrote:
Hi,
> On Thu, 2021-12-09 at 11:06 +0100, Oliver Neukum wrote:
>> As __cancel_work_timer can be called from hci_cmd_sync_cancel() this is
>> just not
>> an approach you can take. It looks like asynchronously canceling the
>> scheduled work
>> would result in a race, so I would for now just revert.
> Right, so this needs to be pushed into a workqueue instead, I suppose.
It looks like overkill, but I have no good alternative to offer either.
>
>> What issue exactly is this trying to fix or improve?
> The problem is aborting long-running synchronous operations. i.e.
> without this patchset, USB enumeration will hang for 10s if a USB
> bluetooth device disappears during firmware loading. This is because
> even though the USB device is gone and all URB submissions fail, the
> operation will only be aborted after the internal timeout happens.
>
I see. Something ought to be done. The issue is in good hands.

=C2=A0=C2=A0=C2=A0 Thanks
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 Oliver