Bluetooth: btusb: fix wakeup irq devres lifetime
PATCH 1/1 Bluetooth: btusb: fix wakeup irq devres lifetime
The OOB wakeup irq is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound.
This should not cause any trouble currently as the interrupt is only enabled during suspend, but it is technically wrong as the reference counted HCI device could remain after the driver has been unbound.
Note that the data passed to the interrupt handler is not device managed and is typically freed before the interrupt during disconnect, but this is also safe as long as the interrupt is disabled.
--- drivers/bluetooth/btusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bluetooth/btusb.c +1 -1
@@ -3801,7 +3801,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) }irq_set_status_flags (irq,IRQ_NOAUTOEN ); - ret =devm_request_irq (&hdev->dev, irq, btusb_oob_wake_handler, + ret =devm_request_irq (&data->intf->dev, irq, btusb_oob_wake_handler,0 ,"OOB Wake-on-BT" , data);if (ret) {bt_dev_err (hdev,"%s: IRQ request failed" , __func__);
Signature · 1 line
2.52.0
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1074460
---Test result---
Test Summary:
CheckPatch PENDING 0.45 seconds GitLint PENDING 0.33 seconds SubjectPrefix PASS 0.10 seconds BuildKernel PASS 25.94 seconds CheckAllWarning PASS 28.37 seconds CheckSparse PASS 27.33 seconds BuildKernel32 PASS 25.09 seconds TestRunnerSetup PASS 559.52 seconds TestRunner_l2cap-tester PASS 27.49 seconds TestRunner_iso-tester PASS 42.70 seconds TestRunner_bnep-tester PASS 6.36 seconds TestRunner_mgmt-tester FAIL 111.57 seconds TestRunner_rfcomm-tester PASS 9.34 seconds TestRunner_sco-tester FAIL 14.17 seconds TestRunner_ioctl-tester PASS 10.00 seconds TestRunner_mesh-tester FAIL 11.51 seconds TestRunner_smp-tester PASS 8.49 seconds TestRunner_userchan-tester PASS 6.60 seconds IncrementalBuild PENDING 1.09 seconds
Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:
##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner Output:
Total: 494, Passed: 485 (98.2%), Failed: 5, Not Run: 4
Failed Test Cases
Adv. connectable & connected (central) - Success Failed 0.124 seconds Adv. non-connectable & connected (central) - Success Failed 0.122 seconds Ext Adv. connectable & connected (central) Failed 0.174 seconds Ext Adv. non-connectable & connected (central) Failed 0.179 seconds Read Exp Feature - Success Failed 0.109 seconds
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner Output:
Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Timed out 1.792 seconds Mesh - Send cancel - 2 Timed out 1.996 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series Output:
---
Regards,
Linux Bluetooth
Luiz Augusto von Dentz
maintainerHi Johan,
Quoted 34 lines · Johan Hovold
The OOB wakeup irq is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound.
This should not cause any trouble currently as the interrupt is only enabled during suspend, but it is technically wrong as the reference counted HCI device could remain after the driver has been unbound.
Note that the data passed to the interrupt handler is not device managed and is typically freed before the interrupt during disconnect, but this is also safe as long as the interrupt is disabled.
Fixes fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support")Cc Rajat Jain <[email protected]>Signed-off-by Johan Hovold <[email protected]>--- drivers/bluetooth/btusb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/bluetooth/btusb.c +1
-2@@ -3801,7 +3801,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) }irq_set_status_flags (irq,IRQ_NOAUTOEN ); - ret =devm_request_irq (&hdev->dev, irq, btusb_oob_wake_handler, + ret =devm_request_irq (&data->intf->dev, irq, btusb_oob_wake_handler,0 ,"OOB Wake-on-BT" , data);if (ret) {bt_dev_err (hdev,"%s: IRQ request failed" , __func__); --
Quoted 1 line
2.52.0
https://sashiko.dev/#/patchset/20260330093311.1621965-1-johan%40kernel.org
Not sure if it is valid though.
Signature · 1 line
Luiz Augusto von Dentz
Hi Luiz,
Quoted 9 lines · Luiz Augusto von Dentz
Quoted 8 lines · Johan Hovold
The OOB wakeup irq is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound.
This should not cause any trouble currently as the interrupt is only enabled during suspend, but it is technically wrong as the reference counted HCI device could remain after the driver has been unbound.
Quoted 7 lines
Quoted 3 lines
Note that the data passed to the interrupt handler is not device managed and is typically freed before the interrupt during disconnect, but this is also safe as long as the interrupt is disabled.
https://sashiko.dev/#/patchset/20260330093311.1621965-1-johan%40kernel.org
Not sure if it is valid though.
I'm afraid it is.
I had missed that the devres behaviour changed in 2023 so that managed resources are now also released when deregistering a device which has no driver.
The point about a possible race if disconnecting while suspended is also valid.
I've just sent a v2 here:
https://lore.kernel.org/lkml/[email protected]/
Johan