2009-05-08 22:59:14

by Bing Zhao

[permalink] [raw]
Subject: bluetooth: module_refcount is not decreased when connection times out



Hi,

The module refcount is increased by hci_dev_hold() call in hci_conn_add() i=
n hci_conn.c, and it is decreased by hci_dev_put() call in "del_conn" (hci_=
sysfs.c).

In case connection timeout happens, hci_dev_put() is never called.

Procedure to reproduce the issue:

# hciconfig hci0 up
# lsmod | grep btusb -> "used by" refcount =3D 1

# hcitool cc <non-exisiting bdaddr> -> will get timeout

# lsmod | grep btusb -> "used by" refcount =3D 2
# hciconfig hci0 down
# lsmod | grep btusb -> "used by" refcount =3D 1
# rmmod btusb -> ERROR: Module btusb is in use


Regards,

Bing


2009-05-09 01:08:42

by Bing Zhao

[permalink] [raw]
Subject: RE: bluetooth: module_refcount is not decreased when connection times out

> Hi Bing,
>=20
> > > > The module refcount is increased by hci_dev_hold() call in hci_conn=
_add() in hci_conn.c, and it
> is
> > > decreased by hci_dev_put() call in "del_conn" (hci_sysfs.c).
> > > >
> > > > In case connection timeout happens, hci_dev_put() is never called.
> > >
> > > can you test the attached patch for quickly. It should fix it.
> >
> > It seems that hdev is "put" twice with the patch, if the connection fai=
ls.
> >
> > # hciconfig hci0 up
> > # lsmod | grep btusb -> "used by" refcount =3D 1
> >
> > # hcitool cc <non-exisiting bdaddr> -> will get timeout
> > # lsmod | grep btusb -> "used by" refcount =3D 0 (??)
> >
> > # hcitool cc <non-exisiting bdaddr> -> time out again
> > # lsmod | grep btusb -> "used by" refcount =3D 4294967295 (??)
>=20
> the previous patch has one tiny bug. Is this one better?
>=20
> Regards
>=20
> Marcel


Hi Marcel,

Thanks for the patch. It works perfectly.

Best regards,

Bing

2009-05-09 00:03:55

by Marcel Holtmann

[permalink] [raw]
Subject: RE: bluetooth: module_refcount is not decreased when connection times out

Hi Bing,

> > > The module refcount is increased by hci_dev_hold() call in hci_conn_add() in hci_conn.c, and it is
> > decreased by hci_dev_put() call in "del_conn" (hci_sysfs.c).
> > >
> > > In case connection timeout happens, hci_dev_put() is never called.
> >
> > can you test the attached patch for quickly. It should fix it.
>
> It seems that hdev is "put" twice with the patch, if the connection fails.
>
> # hciconfig hci0 up
> # lsmod | grep btusb -> "used by" refcount = 1
>
> # hcitool cc <non-exisiting bdaddr> -> will get timeout
> # lsmod | grep btusb -> "used by" refcount = 0 (??)
>
> # hcitool cc <non-exisiting bdaddr> -> time out again
> # lsmod | grep btusb -> "used by" refcount = 4294967295 (??)

the previous patch has one tiny bug. Is this one better?

Regards

Marcel


Attachments:
patch-fix-hci-dev-refcount-v2 (763.00 B)

2009-05-09 00:01:00

by Bing Zhao

[permalink] [raw]
Subject: RE: bluetooth: module_refcount is not decreased when connection times out

> Hi Bing,
>=20
> > The module refcount is increased by hci_dev_hold() call in hci_conn_add=
() in hci_conn.c, and it is
> decreased by hci_dev_put() call in "del_conn" (hci_sysfs.c).
> >
> > In case connection timeout happens, hci_dev_put() is never called.
>=20
> can you test the attached patch for quickly. It should fix it.
>=20
> Regards
>=20
> Marcel


Hi Marcel,

It seems that hdev is "put" twice with the patch, if the connection fails.

# hciconfig hci0 up
# lsmod | grep btusb -> "used by" refcount =3D 1

# hcitool cc <non-exisiting bdaddr> -> will get timeout
# lsmod | grep btusb -> "used by" refcount =3D 0 (??)

# hcitool cc <non-exisiting bdaddr> -> time out again
# lsmod | grep btusb -> "used by" refcount =3D 4294967295 (??)


Thanks,

Bing

2009-05-08 23:27:19

by Marcel Holtmann

[permalink] [raw]
Subject: Re: bluetooth: module_refcount is not decreased when connection times out

Hi Bing,

> The module refcount is increased by hci_dev_hold() call in hci_conn_add() in hci_conn.c, and it is decreased by hci_dev_put() call in "del_conn" (hci_sysfs.c).
>
> In case connection timeout happens, hci_dev_put() is never called.

can you test the attached patch for quickly. It should fix it.

Regards

Marcel


Attachments:
patch-fix-hci-dev-refcount (975.00 B)

2009-05-08 23:20:19

by Marcel Holtmann

[permalink] [raw]
Subject: Re: bluetooth: module_refcount is not decreased when connection times out

Hi Bing,

> The module refcount is increased by hci_dev_hold() call in hci_conn_add() in hci_conn.c, and it is decreased by hci_dev_put() call in "del_conn" (hci_sysfs.c).
>
> In case connection timeout happens, hci_dev_put() is never called.
>
> Procedure to reproduce the issue:
>
> # hciconfig hci0 up
> # lsmod | grep btusb -> "used by" refcount = 1
>
> # hcitool cc <non-exisiting bdaddr> -> will get timeout
>
> # lsmod | grep btusb -> "used by" refcount = 2
> # hciconfig hci0 down
> # lsmod | grep btusb -> "used by" refcount = 1
> # rmmod btusb -> ERROR: Module btusb is in use

I have seen that happen before, but never had the time to check up on
them. Your analysis seems correct. Would have to check on how to fix
this. Proposals are welcome.

Regards

Marcel