hdev->block_len could be 0. Fix this by adding a check.
divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G W 6.9.0-rc6-00001-g38e1170f515d-dirty #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci11 hci_tx_work
RIP: 0010:__get_blocks net/bluetooth/hci_core.c:3618 [inline]
RIP: 0010:hci_sched_acl_blk net/bluetooth/hci_core.c:3766 [inline]
RIP: 0010:hci_sched_acl net/bluetooth/hci_core.c:3806 [inline]
RIP: 0010:hci_tx_work+0x73e/0x1d10 net/bluetooth/hci_core.c:3901
Fixes: b71d385a18cd ("Bluetooth: Recalculate sched HCI blk/pkt flow ctrl")
Signed-off-by: Sungwoo Kim <[email protected]>
---
net/bluetooth/hci_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 0efd59760..20b1cd7f3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3762,7 +3762,7 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
__check_timeout(hdev, cnt, type);
- while (hdev->block_cnt > 0 &&
+ while (hdev->block_len > 0 && hdev->block_cnt > 0 &&
(chan = hci_chan_sent(hdev, type, "e))) {
u32 priority = (skb_peek(&chan->data_q))->priority;
while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
--
2.34.1
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=850652
---Test result---
Test Summary:
CheckPatch FAIL 1.13 seconds
GitLint FAIL 0.54 seconds
SubjectPrefix PASS 0.12 seconds
BuildKernel PASS 30.07 seconds
CheckAllWarning PASS 32.76 seconds
CheckSparse PASS 38.40 seconds
CheckSmatch FAIL 36.66 seconds
BuildKernel32 PASS 28.71 seconds
TestRunnerSetup PASS 517.65 seconds
TestRunner_l2cap-tester PASS 18.30 seconds
TestRunner_iso-tester PASS 30.58 seconds
TestRunner_bnep-tester PASS 4.68 seconds
TestRunner_mgmt-tester FAIL 110.53 seconds
TestRunner_rfcomm-tester PASS 7.24 seconds
TestRunner_sco-tester PASS 13.00 seconds
TestRunner_ioctl-tester PASS 7.60 seconds
TestRunner_mesh-tester PASS 5.80 seconds
TestRunner_smp-tester PASS 6.78 seconds
TestRunner_userchan-tester PASS 4.92 seconds
IncrementalBuild PASS 29.55 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
Bluetooth: HCI: fix divide error in __get_blocks()
WARNING: Prefer a maximum 75 chars per line (possible unwrapped commit description?)
#83:
CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G W 6.9.0-rc6-00001-g38e1170f515d-dirty #32
total: 0 errors, 1 warnings, 0 checks, 8 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/src/13654829.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: HCI: fix divide error in __get_blocks()
WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
6: B1 Line exceeds max length (104>80): "CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G W 6.9.0-rc6-00001-g38e1170f515d-dirty #32"
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bpa10x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bpa10x.o'
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 492, Passed: 489 (99.4%), Failed: 1, Not Run: 2
Failed Test Cases
LL Privacy - Add Device 7 (AL is full) Failed 0.194 seconds
---
Regards,
Linux Bluetooth
Hi,
On Sun, May 5, 2024 at 10:21 PM Sungwoo Kim <[email protected]> wrote:
>
> hdev->block_len could be 0. Fix this by adding a check.
>
> divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
> CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G W 6.9.0-rc6-00001-g38e1170f515d-dirty #32
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Workqueue: hci11 hci_tx_work
> RIP: 0010:__get_blocks net/bluetooth/hci_core.c:3618 [inline]
> RIP: 0010:hci_sched_acl_blk net/bluetooth/hci_core.c:3766 [inline]
> RIP: 0010:hci_sched_acl net/bluetooth/hci_core.c:3806 [inline]
> RIP: 0010:hci_tx_work+0x73e/0x1d10 net/bluetooth/hci_core.c:3901
>
> Fixes: b71d385a18cd ("Bluetooth: Recalculate sched HCI blk/pkt flow ctrl")
> Signed-off-by: Sungwoo Kim <[email protected]>
> ---
> net/bluetooth/hci_core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
> index 0efd59760..20b1cd7f3 100644
> --- a/net/bluetooth/hci_core.c
> +++ b/net/bluetooth/hci_core.c
> @@ -3762,7 +3762,7 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
>
> __check_timeout(hdev, cnt, type);
>
> - while (hdev->block_cnt > 0 &&
> + while (hdev->block_len > 0 && hdev->block_cnt > 0 &&
> (chan = hci_chan_sent(hdev, type, "e))) {
> u32 priority = (skb_peek(&chan->data_q))->priority;
> while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
> --
> 2.34.1
Hmm, this code shall probably be removed as well since
HCI_FLOW_CTL_MODE_BLOCK_BASED was sort of tight to AMP support which
we have removed support for, anyway this is failing late actually
since we might have to check this during hci_conn_add with:
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 171a667bc991..73b9d08438fe 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -907,8 +907,16 @@ struct hci_conn *hci_conn_add(struct hci_dev
*hdev, int type, bdaddr_t *dst,
switch (type) {
case ACL_LINK:
- if (!hdev->acl_mtu)
- return ERR_PTR(-ECONNREFUSED);
+ switch (hdev->flow_ctl_mode) {
+ case HCI_FLOW_CTL_MODE_PACKET_BASED:
+ if (!hdev->acl_mtu)
+ return ERR_PTR(-ECONNREFUSED);
+ break;
+ case HCI_FLOW_CTL_MODE_BLOCK_BASED:
+ if (!hdev->block_mtu)
+ return ERR_PTR(-ECONNREFUSED);
+ break;
+ }
break;
case ISO_LINK:
if (hdev->iso_mtu)
@@ -966,7 +974,14 @@ struct hci_conn *hci_conn_add(struct hci_dev
*hdev, int type, bdaddr_t *dst,
switch (type) {
case ACL_LINK:
conn->pkt_type = hdev->pkt_type & ACL_PTYPE_MASK;
- conn->mtu = hdev->acl_mtu;
+ switch (hdev->flow_ctl_mode) {
+ case HCI_FLOW_CTL_MODE_PACKET_BASED:
+ conn->mtu = hdev->acl_mtu;
+ break;
+ case HCI_FLOW_CTL_MODE_BLOCK_BASED:
+ conn->mtu = hdev->block_mtu;
+ break;
+ }
break;
case LE_LINK:
/* conn->src should reflect the local identity address */
--
Luiz Augusto von Dentz