Bluetooth: Fix deadlock in l2cap_conn_del()
authorJukka Taimisto <jtt@codenomicon.com>
Thu, 12 Jun 2014 10:15:13 +0000 (10:15 +0000)
committerMarcel Holtmann <marcel@holtmann.org>
Fri, 13 Jun 2014 11:32:26 +0000 (13:32 +0200)
commit7ab56c3a6eccb215034b0cb096e0313441cbf2a4
tree45dffdd269270c44ce1a98ea0d7fc589891b4180
parentf8680f128b01212895a9afb31032f6ffe91bd771
Bluetooth: Fix deadlock in l2cap_conn_del()

A deadlock occurs when PDU containing invalid SMP opcode is received on
Security Manager Channel over LE link and conn->pending_rx_work worker
has not run yet.

When LE link is created l2cap_conn_ready() is called and before
returning it schedules conn->pending_rx_work worker to hdev->workqueue.
Incoming data to SMP fixed channel is handled by l2cap_recv_frame()
which calls smp_sig_channel() to handle the SMP PDU. If
smp_sig_channel() indicates failure l2cap_conn_del() is called to delete
the connection. When deleting the connection, l2cap_conn_del() purges
the pending_rx queue and calls flush_work() to wait for the
pending_rx_work worker to complete.

Since incoming data is handled by a worker running from the same
workqueue as the pending_rx_work is being scheduled on, we will deadlock
on waiting for pending_rx_work to complete.

This patch fixes the deadlock by calling cancel_work_sync() instead of
flush_work().

Signed-off-by: Jukka Taimisto <jtt@codenomicon.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
net/bluetooth/l2cap_core.c