Skip to contentSkip to conversation

"File descriptor in bad state" on sdp_connect()

Bluez-devel Marco Pracucci 5 participants 16 messages Aug 8, 2006 – Aug 16, 2006

Subsystems (2)
Bluetooth drivers Bluetooth
lore
Share & tools
lore

Marco Pracucci

author
#0 lore raw

Hi,

I have a problem with multiple concurrent calls to sdp_connect(). In particular, I have a simple application that search a service on different remote devices: the searches are done concurrently (until 7 in parallel), each from within a different pthread. I have experienced that, with a lot of Bluetooth dongles (example Surecom, D-Link), it occurs an "File descriptor in bad state" error. Debugging the sdp_connect() function I have founded that the error occurs on connect() system call.

Has anyone had a similar problem?
Do you have any suggestion?

Thanks,
Marco Pracucci

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#1 lore raw

Hi Marco,

Quoted 11 lines · Marco Pracucci

Hi,

I have a problem with multiple concurrent calls to sdp_connect(). In particular, I have a simple application that search a service on different remote devices: the searches are done concurrently (until 7 in parallel), each from within a different pthread. I have experienced that, with a lot of Bluetooth dongles (example Surecom, D-Link), it occurs an "File descriptor in bad state" error. Debugging the sdp_connect() function I have founded that the error occurs on connect() system call.

This problem has been discussed here several times for various applications. It is not related to SDP but to the general problem that (all ?) commercial available Bluetooth adaptors do not support multiple (concurrent) connection requests. The only solution is to serialize the connect requests. Until now nobody voluntered to do this in the kernel.

Ciao,

Peter

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#2 lore raw

Hi Peter,

Quoted 9 lines · Peter Wippich
Quoted 9 lines

I have a problem with multiple concurrent calls to sdp_connect(). In particular, I have a simple application that search a service on different remote devices: the searches are done concurrently (until 7 in parallel), each from within a different pthread. I have experienced that, with a lot of Bluetooth dongles (example Surecom, D-Link), it occurs an "File descriptor in bad state" error. Debugging the sdp_connect() function I have founded that the error occurs on connect() system call.

Quoted 5 lines

This problem has been discussed here several times for various applications. It is not related to SDP but to the general problem that (all ?) commercial available Bluetooth adaptors do not support multiple (concurrent) connection requests. The only solution is to serialize the connect requests. Until now nobody voluntered to do this in the kernel.

I'm working on this right now. I think I've found the problems with that Marcel Holtmann's patch. I'm gonna test it a little bit more and then I'll send the patch to the list. :-)

Regards,

-- Ulisses

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#3 lore raw
In reply to Marco Pracucci

Hi,
I have had a similar problem ....I've discovered (with Marcel help) is a problem in l2cap layer.
l2cap kernel module do not handle multiple connect, Marcel send to me a patch I am trying to make to work
but I'm very busy with my job and is not still clear where the patch
hangs the system.

You can found some information searching in old messages....

Ciao
Fabrizio

Marco Pracucci ha scritto:

Quoted 18 lines

Hi,

I have a problem with multiple concurrent calls to sdp_connect(). In particular, I have a simple application that search a service on different remote devices: the searches are done concurrently (until 7 in parallel), each from within a different pthread. I have experienced that, with a lot of Bluetooth dongles (example Surecom, D-Link), it occurs an "File descriptor in bad state" error. Debugging the sdp_connect() function I have founded that the error occurs on connect() system call.

Has anyone had a similar problem?
Do you have any suggestion?

Thanks,
Marco Pracucci

Quoted 12 lines

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#4 lore raw

Hi Fabrizio,

Quoted 6 lines · Fabrizio Guglielmino

I have had a similar problem ....I've discovered (with Marcel help) is a problem in l2cap layer.
l2cap kernel module do not handle multiple connect, Marcel send to me a patch I am trying to make to work
but I'm very busy with my job and is not still clear where the patch
hangs the system.

We thought we had a deadlock somewhere but it wasn't the case. We had two problems:

- trying to list_del() the same list entry twice leading us to a page fault
- we've forgotten to INIT_LIST_HEAD() our l2cap_conn->list leading us to a NULL pointer dereference

I've done some modifications (and also included some bits from -mh) and it seems to be working. However, I'm hitting a kernel bug at kernel/timer.c inside cascade() from time to time. I haven't found what is causing this yet, but the patch I'm sending is against 2.6.17 and I haven't tested with latest git snapshot so maybe this issue is already fixed upstream (kernel/timer.c:cascade() was changed [1]). Marcel, do you have any idea of what might be happening?

If anyone wants to give this beast a try you're warned that it might lock up your system. FWIW, a quick test can be done using l2test from CVS like:

 $ ./l2test -m bd_addr1 bd_addr2 ...

Best regards,

-- Ulisses

[1] http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blobdiff;h=b650f04888ed6dbc6abb07adcee5c58a8f27c374;hp=9062a82ee8ec40d9a6ef985c625bd8daaf5778c5;hb=a2c348fe0117adced11e374329a5ea3f7c43cb41;f=kernel/timer.c

include/net/bluetooth/l2cap.h +2 -0
diff -urN linux-2.6.17/include/net/bluetooth/l2cap.h linux-2.6.17-dev/include/net/bluetooth/l2cap.h
@@ -183,6 +183,8 @@
 };
 
 struct l2cap_conn {
+	struct list_head list;
+
 	struct hci_conn	*hcon;
 
 	bdaddr_t	*dst;
net/bluetooth/l2cap.c +65 -27

169 lines not on this page · raw message

maintainer
#5 lore raw

Hi Ulisses,

Quoted 14 lines
Quoted 6 lines

I have had a similar problem ....I've discovered (with Marcel help) is a problem in l2cap layer.
l2cap kernel module do not handle multiple connect, Marcel send to me a patch I am trying to make to work
but I'm very busy with my job and is not still clear where the patch
hangs the system.

We thought we had a deadlock somewhere but it wasn't the case. We had two problems:

- trying to list_del() the same list entry twice leading us to a page fault
- we've forgotten to INIT_LIST_HEAD() our l2cap_conn->list leading us
to a NULL pointer dereference

Quoted 6 lines

I've done some modifications (and also included some bits from -mh) and it seems to be working. However, I'm hitting a kernel bug at kernel/timer.c inside cascade() from time to time. I haven't found what is causing this yet, but the patch I'm sending is against 2.6.17 and I haven't tested with latest git snapshot so maybe this issue is already fixed upstream (kernel/timer.c:cascade() was changed [1]).

please redo the patch against 2.6.18-rc4 and I will do some additional testing.

Regards

Marcel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#6 lore raw

Hi Marcel,

Quoted 9 lines · Marcel Holtmann
Quoted 6 lines

I've done some modifications (and also included some bits from -mh) and it seems to be working. However, I'm hitting a kernel bug at kernel/timer.c inside cascade() from time to time. I haven't found what is causing this yet, but the patch I'm sending is against 2.6.17 and I haven't tested with latest git snapshot so maybe this issue is already fixed upstream (kernel/timer.c:cascade() was changed [1]).

please redo the patch against 2.6.18-rc4 and I will do some additional testing.

Done. Here is the same patch against 2.6.18-rc4.

Regards,

-- Ulisses

include/net/bluetooth/l2cap.h +2 -0
diff -urN linux-2.6.18-rc4/include/net/bluetooth/l2cap.h linux-2.6.18-rc4-dev/include/net/bluetooth/l2cap.h
@@ -183,6 +183,8 @@
 };
 
 struct l2cap_conn {
+	struct list_head list;
+
 	struct hci_conn	*hcon;
 
 	bdaddr_t	*dst;
net/bluetooth/l2cap.c +54 -16

96 lines not on this page · raw message

maintainer
#7 lore raw

Hi Ulisses,

Quoted 11 lines
Quoted 9 lines
Quoted 6 lines

I've done some modifications (and also included some bits from -mh) and it seems to be working. However, I'm hitting a kernel bug at kernel/timer.c inside cascade() from time to time. I haven't found what is causing this yet, but the patch I'm sending is against 2.6.17 and I haven't tested with latest git snapshot so maybe this issue is already fixed upstream (kernel/timer.c:cascade() was changed [1]).

please redo the patch against 2.6.18-rc4 and I will do some additional testing.

Done. Here is the same patch against 2.6.18-rc4.

I tested this patch on my Quad G5. I don't see any timer issues, but it also doesn't work either.

Regards

Marcel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#8 lore raw

Hi Marcel,

Quoted 7 lines · Marcel Holtmann
Quoted 4 lines
Quoted 2 lines

please redo the patch against 2.6.18-rc4 and I will do some additional testing.

Done. Here is the same patch against 2.6.18-rc4.

I tested this patch on my Quad G5. I don't see any timer issues, but it also doesn't work either.

Damn it. You don't have an HCI dump while l2test is running, do you? (or even l2test output, debug messages..). Thanks.

Regards,

-- Ulisses

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

maintainer
#9 lore raw

Hi Ulisses,

Quoted 10 lines
Quoted 7 lines
Quoted 4 lines
Quoted 2 lines

please redo the patch against 2.6.18-rc4 and I will do some additional testing.

Done. Here is the same patch against 2.6.18-rc4.

I tested this patch on my Quad G5. I don't see any timer issues, but it also doesn't work either.

Damn it. You don't have an HCI dump while l2test is running, do you? (or even l2test output, debug messages..). Thanks.

now my machine freezed when I tried to get a hcidump for you. However I remember seeing the Command Disallowed error and after the Connect Complete, I didn't see the additional Create Connection.

Regards

Marcel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

maintainer
#10 lore raw
In reply to Ulisses Furquim

Hi Ulisses,

Quoted 11 lines
Quoted 6 lines

I have had a similar problem ....I've discovered (with Marcel help) is a problem in l2cap layer.
l2cap kernel module do not handle multiple connect, Marcel send to me a patch I am trying to make to work
but I'm very busy with my job and is not still clear where the patch
hangs the system.

We thought we had a deadlock somewhere but it wasn't the case. We had two problems:

- trying to list_del() the same list entry twice leading us to a page fault

where do we delete the entry twice?

Quoted 2 lines

- we've forgotten to INIT_LIST_HEAD() our l2cap_conn->list leading us
to a NULL pointer dereference

This must be another bug, because it is not needed to init the list item itself. You only have to init the list head.

The attached patch should not change any behavior, but keep track of L2CAP connections in creation state. Please test and check the output of dmesg.

Regards

Marcel

include/net/bluetooth/l2cap.h +2 -0
index 8242a0e..cb19e66 100644
@@ -183,6 +183,8 @@ struct l2cap_chan_list {
 };
 
 struct l2cap_conn {
+	struct list_head list;
+
 	struct hci_conn	*hcon;
 
 	bdaddr_t	*dst;
net/bluetooth/l2cap.c +67 -17

116 lines not on this page · raw message

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#11 lore raw

Hi Marcel,

Quoted 3 lines · Marcel Holtmann
Quoted 1 line

- trying to list_del() the same list entry twice leading us to a page fault

where do we delete the entry twice?

On the first version of the patch (the one you sent to the list) there was a list_del() inside l2cap_conn_del(). This list_del() was causing a page fault trying to dereference prev and next pointers that were poisoned because of a previous list_del().

Quoted 5 lines
Quoted 2 lines

- we've forgotten to INIT_LIST_HEAD() our l2cap_conn->list leading us
to a NULL pointer dereference

This must be another bug, because it is not needed to init the list item itself. You only have to init the list head.

Hmm.. I think you're right as we already declare our list head with LIST_HEAD(). I was seeing a NULL pointer dereference inside list_del(), tough. Weird.

Quoted 3 lines

The attached patch should not change any behavior, but keep track of L2CAP connections in creation state. Please test and check the output of dmesg.

Ok.

-- Ulisses

#12 lore raw
In reply to Marcel Holtmann

Hi Marcel,

Quoted 3 lines · Marcel Holtmann

The attached patch should not change any behavior, but keep track of L2CAP connections in creation state. Please test and check the output of dmesg.

Hmm.. actually it changes the behavior a little bit. This part:

	default:
		conn = hcon->l2cap_data;
		if (!conn)
			break;

		spin_lock_bh(&l2cap_conn_lock);
		list_del(&conn->list);
		spin_unlock_bh(&l2cap_conn_lock);

		l2cap_conn_del(hcon, bt_err(status));
		break;

should be like the following code. Otherwise we end up not calling l2cap_conn_del() on hcon, right? (or am I missing anything?)

      default:
              if ((conn = hcon->l2cap_data)) {
                      spin_lock_bh(&l2cap_conn_lock);
                      list_del(&conn->list);
                      spin_unlock_bh(&l2cap_conn_lock);
              }
              l2cap_conn_del(hcon, bt_err(status));
              break;

Best regards,

-- Ulisses

maintainer
#13 lore raw

Hi Ulisses,

Quoted 21 lines
Quoted 3 lines

The attached patch should not change any behavior, but keep track of L2CAP connections in creation state. Please test and check the output of dmesg.

Hmm.. actually it changes the behavior a little bit. This part:

	default:
		conn = hcon->l2cap_data;
		if (!conn)
			break;

		spin_lock_bh(&l2cap_conn_lock);
		list_del(&conn->list);
		spin_unlock_bh(&l2cap_conn_lock);
 		l2cap_conn_del(hcon, bt_err(status));
		break;

should be like the following code. Otherwise we end up not calling l2cap_conn_del() on hcon, right? (or am I missing anything?)

Quoted 8 lines
       default:
               if ((conn = hcon->l2cap_data)) {
                       spin_lock_bh(&l2cap_conn_lock);
                       list_del(&conn->list);
                       spin_unlock_bh(&l2cap_conn_lock);
               }
               l2cap_conn_del(hcon, bt_err(status));
               break;

look into l2cap_conn_del() and check what happens if l2cap_data is NULL. This doesn't change the behavior.

Regards

Marcel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

#14 lore raw
Quoted 2 lines · Marcel Holtmann

look into l2cap_conn_del() and check what happens if l2cap_data is NULL. This doesn't change the behavior.

Doooh. Right. We shouldn't be calling l2cap_conn_del() at all if l2cap_data is NULL so it doesn't change any behavior and we actually save one function call. :-)

Regards,

-- Ulisses

#15 lore raw

Hi Ulisses,
I have been outside for a few days...and now I'm reading all the mail about sdp_connect problem.
if I find the time I install the patch on a development system so I try to contribute to the final version.

bye

Il giorno 11/ago/06, alle ore 22:09, Ulisses Furquim ha scritto:

Quoted 13 lines · Marcel Holtmann
Quoted 3 lines

look into l2cap_conn_del() and check what happens if l2cap_data is NULL.
This doesn't change the behavior.

Doooh. Right. We shouldn't be calling l2cap_conn_del() at all if l2cap_data is NULL so it doesn't change any behavior and we actually save one function call. :-)

Regards,

-- Ulisses

Quoted 15 lines

----------------------------------------------------------------------
---
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?
cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list [email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel