2012-02-24 14:35:32

by Andrei Emeltchenko

Subject: [PATCH] Bluetooth: Fix double locking in LE and conless chan

From: Andrei Emeltchenko <[email protected]>

Remove socket lock since chan->ops->recv locks socket itself.

Signed-off-by: Andrei Emeltchenko <[email protected]>
---
net/bluetooth/l2cap_core.c | 24 ++++--------------------
1 files changed, 4 insertions(+), 20 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b2f1565..ed50e4a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -4382,18 +4382,13 @@ done:

static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
{
- struct sock *sk = NULL;
struct l2cap_chan *chan;

chan = l2cap_global_chan_by_psm(0, psm, conn->src);
if (!chan)
goto drop;

- sk = chan->sk;
-
- lock_sock(sk);
-
- BT_DBG("sk %p, len %d", sk, skb->len);
+ BT_DBG("chan %p, len %d", chan, skb->len);

if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
goto drop;
@@ -4402,31 +4397,23 @@ static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, str
goto drop;

if (!chan->ops->recv(chan->data, skb))
- goto done;
+ return 0;

drop:
kfree_skb(skb);

-done:
- if (sk)
- release_sock(sk);
return 0;
}

static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb)
{
- struct sock *sk = NULL;
struct l2cap_chan *chan;

chan = l2cap_global_chan_by_scid(0, cid, conn->src);
if (!chan)
goto drop;

- sk = chan->sk;
-
- lock_sock(sk);
-
- BT_DBG("sk %p, len %d", sk, skb->len);
+ BT_DBG("chan %p, len %d", chan, skb->len);

if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
goto drop;
@@ -4435,14 +4422,11 @@ static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct
goto drop;

if (!chan->ops->recv(chan->data, skb))
- goto done;
+ return 0;

drop:
kfree_skb(skb);

-done:
- if (sk)
- release_sock(sk);
return 0;
}

--
1.7.9

2012-02-24 20:28:13

by Johan Hedberg

Subject: Re: [PATCH] Bluetooth: Fix double locking in LE and conless chan

Hi Andrei,

On Fri, Feb 24, 2012, Andrei Emeltchenko wrote:
> Remove socket lock since chan->ops->recv locks socket itself.
>
> Signed-off-by: Andrei Emeltchenko <[email protected]>
> ---
> net/bluetooth/l2cap_core.c | 24 ++++--------------------
> 1 files changed, 4 insertions(+), 20 deletions(-)

Applied. Thanks.

Johan

2012-02-24 20:21:02

by Gustavo Padovan

Subject: Re: [PATCH] Bluetooth: Fix double locking in LE and conless chan

Hi Andrei,

* Andrei Emeltchenko <[email protected]> [2012-02-24 16:35:32 +0200]:

> From: Andrei Emeltchenko <[email protected]>
>
> Remove socket lock since chan->ops->recv locks socket itself.
>
> Signed-off-by: Andrei Emeltchenko <[email protected]>
> ---
> net/bluetooth/l2cap_core.c | 24 ++++--------------------
> 1 files changed, 4 insertions(+), 20 deletions(-)

Acked-by: Gustavo F. Padovan <[email protected]>

Gustavo

2012-02-24 16:35:27

by Ulisses Furquim

Subject: Re: [PATCH] Bluetooth: Fix double locking in LE and conless chan

Hi Andrei,

On Fri, Feb 24, 2012 at 12:35 PM, Andrei Emeltchenko
<[email protected]> wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> Remove socket lock since chan->ops->recv locks socket itself.
>
> Signed-off-by: Andrei Emeltchenko <[email protected]>
> ---
> ?net/bluetooth/l2cap_core.c | ? 24 ++++--------------------
> ?1 files changed, 4 insertions(+), 20 deletions(-)

Looks good. Please remember to test these paths too when making
changes that touch whole L2CAP core.

Reviewed-by: Ulisses Furquim <[email protected]>

Regards,

--
Ulisses Furquim
ProFUSION embedded systems
http://profusion.mobi
Mobile: +55 19 9250 0942
Skype: ulissesffs