From patchwork Wed Nov 21 17:27:09 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gustavo F. Padovan" X-Patchwork-Id: 200814 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6AF072C008D for ; Thu, 22 Nov 2012 04:27:37 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755349Ab2KUR1T (ORCPT ); Wed, 21 Nov 2012 12:27:19 -0500 Received: from mail-qa0-f46.google.com ([209.85.216.46]:42563 "EHLO mail-qa0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754668Ab2KUR1R (ORCPT ); Wed, 21 Nov 2012 12:27:17 -0500 Received: by mail-qa0-f46.google.com with SMTP id c11so62148qad.19 for ; Wed, 21 Nov 2012 09:27:16 -0800 (PST) Received: by 10.224.109.199 with SMTP id k7mr19019083qap.66.1353518836830; Wed, 21 Nov 2012 09:27:16 -0800 (PST) Received: from joana ([187.64.221.181]) by mx.google.com with ESMTPS id i9sm601948qak.3.2012.11.21.09.27.13 (version=TLSv1/SSLv3 cipher=OTHER); Wed, 21 Nov 2012 09:27:15 -0800 (PST) Date: Wed, 21 Nov 2012 15:27:09 -0200 From: Gustavo Padovan To: Sasha Levin Cc: marcel@holtmann.org, Johan Hedberg , "David S. Miller" , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, "linux-kernel@vger.kernel.org" , Dave Jones Subject: Re: net, bluetooth: object debug warning in bt_host_release() Message-ID: <20121121172709.GB15370@joana> Mail-Followup-To: Gustavo Padovan , Sasha Levin , marcel@holtmann.org, Johan Hedberg , "David S. Miller" , linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, "linux-kernel@vger.kernel.org" , Dave Jones References: <50A272E7.9080103@oracle.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <50A272E7.9080103@oracle.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org * Sasha Levin [2012-11-13 11:18:47 -0500]: > Hi all, > > While fuzzing with trinity on a KVM tools (lkvm) guest running latest -next kernel I've > stumbled on the following: > > [ 1434.201149] ------------[ cut here ]------------ > [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0() > [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci_power_on+0x0/0x90 > [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-next-20121112-sasha-00018-g2f4ce0e #127 > [ 1434.210760] Call Trace: > [ 1434.210760] [] ? debug_print_object+0x8e/0xb0 > [ 1434.210760] [] warn_slowpath_common+0x87/0xb0 > [ 1434.210760] [] warn_slowpath_fmt+0x41/0x50 > [ 1434.210760] [] debug_print_object+0x8e/0xb0 > [ 1434.210760] [] ? hci_dev_open+0x310/0x310 > [ 1434.210760] [] ? _raw_spin_unlock_irqrestore+0x55/0xa0 > [ 1434.210760] [] __debug_check_no_obj_freed+0xa5/0x230 > [ 1434.210760] [] ? bt_host_release+0x10/0x20 > [ 1434.210760] [] debug_check_no_obj_freed+0x15/0x20 > [ 1434.210760] [] kfree+0x227/0x330 > [ 1434.210760] [] bt_host_release+0x10/0x20 > [ 1434.210760] [] device_release+0x65/0xc0 > [ 1434.210760] [] kobject_cleanup+0x145/0x190 > [ 1434.210760] [] kobject_release+0xd/0x10 > [ 1434.210760] [] kobject_put+0x4c/0x60 > [ 1434.210760] [] put_device+0x12/0x20 > [ 1434.210760] [] hci_free_dev+0x24/0x30 > [ 1434.210760] [] vhci_release+0x31/0x60 > [ 1434.210760] [] __fput+0x122/0x250 > [ 1434.210760] [] ? rcu_user_exit+0x9d/0xd0 > [ 1434.210760] [] ____fput+0x9/0x10 > [ 1434.210760] [] task_work_run+0xb2/0xf0 > [ 1434.210760] [] do_notify_resume+0x77/0xa0 > [ 1434.210760] [] int_signal+0x12/0x17 > [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]--- > > Not that the guest doesn't emulate anything that looks like a bluetooth device or > has bluetooth capabilities. You have a virtual bluetooth device (vhci). That is why you get a bluetooth crash. I think the following patch will fix this issue. Gustavo --- Author: Gustavo Padovan Date: Wed Nov 21 00:50:21 2012 -0200 Bluetooth: cancel power_on work when unregistering the device We need to cancel the hci_power_on work in order to avoid it run when we try to free the hdev. [ 1434.201149] ------------[ cut here ]------------ [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0() [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: _power_on+0x0/0x90 [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-n 20121112-sasha-00018-g2f4ce0e #127 [ 1434.210760] Call Trace: [ 1434.210760] [] ? debug_print_object+0x8e/0xb0 [ 1434.210760] [] warn_slowpath_common+0x87/0xb0 [ 1434.210760] [] warn_slowpath_fmt+0x41/0x50 [ 1434.210760] [] debug_print_object+0x8e/0xb0 [ 1434.210760] [] ? hci_dev_open+0x310/0x310 [ 1434.210760] [] ? _raw_spin_unlock_irqrestore+0x55/0xa0 [ 1434.210760] [] __debug_check_no_obj_freed+0xa5/0x230 [ 1434.210760] [] ? bt_host_release+0x10/0x20 [ 1434.210760] [] debug_check_no_obj_freed+0x15/0x20 [ 1434.210760] [] kfree+0x227/0x330 [ 1434.210760] [] bt_host_release+0x10/0x20 [ 1434.210760] [] device_release+0x65/0xc0 [ 1434.210760] [] kobject_cleanup+0x145/0x190 [ 1434.210760] [] kobject_release+0xd/0x10 [ 1434.210760] [] kobject_put+0x4c/0x60 [ 1434.210760] [] put_device+0x12/0x20 [ 1434.210760] [] hci_free_dev+0x24/0x30 [ 1434.210760] [] vhci_release+0x31/0x60 [ 1434.210760] [] __fput+0x122/0x250 [ 1434.210760] [] ? rcu_user_exit+0x9d/0xd0 [ 1434.210760] [] ____fput+0x9/0x10 [ 1434.210760] [] task_work_run+0xb2/0xf0 [ 1434.210760] [] do_notify_resume+0x77/0xa0 [ 1434.210760] [] int_signal+0x12/0x17 [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]--- Reported-by: Sasha Levin Signed-off-by: Gustavo Padovan diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 81f4bac..69eb644 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1854,6 +1854,8 @@ void hci_unregister_dev(struct hci_dev *hdev) for (i = 0; i < NUM_REASSEMBLY; i++) kfree_skb(hdev->reassembly[i]); + cancel_work_sync(&hdev->power_on); + if (!test_bit(HCI_INIT, &hdev->flags) && !test_bit(HCI_SETUP, &hdev->dev_flags)) { hci_dev_lock(hdev);