Skip to content

Commit fdd9ebc

Browse files
kuba-mookuba-moo
committed
Merge tag 'for-net-2025-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - MGMT: Fix UAF on mgmt_remove_adv_monitor_complete - MGMT: Protect mgmt_pending list with its own lock - hci_core: fix list_for_each_entry_rcu usage - btintel_pcie: Increase the tx and rx descriptor count - btintel_pcie: Reduce driver buffer posting to prevent race condition - btintel_pcie: Fix driver not posting maximum rx buffers * tag 'for-net-2025-06-05' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Protect mgmt_pending list with its own lock Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete Bluetooth: btintel_pcie: Reduce driver buffer posting to prevent race condition Bluetooth: btintel_pcie: Increase the tx and rx descriptor count Bluetooth: btintel_pcie: Fix driver not posting maximum rx buffers Bluetooth: hci_core: fix list_for_each_entry_rcu usage ==================== Link: https://patch.msgid.link/20250605191136.904411-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents 82ffbe7 + 6fe26f6 commit fdd9ebc

File tree

7 files changed

+118
-115
lines changed

7 files changed

+118
-115
lines changed

‎drivers/bluetooth/btintel_pcie.c‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -396,8 +396,13 @@ static int btintel_pcie_submit_rx(struct btintel_pcie_data *data)
396396
static int btintel_pcie_start_rx(struct btintel_pcie_data *data)
397397
{
398398
int i, ret;
399+
struct rxq *rxq = &data->rxq;
400+
401+
/* Post (BTINTEL_PCIE_RX_DESCS_COUNT - 3) buffers to overcome the
402+
* hardware issues leading to race condition at the firmware.
403+
*/
399404

400-
for (i = 0; i < BTINTEL_PCIE_RX_MAX_QUEUE; i++) {
405+
for (i = 0; i < rxq->count - 3; i++) {
401406
ret = btintel_pcie_submit_rx(data);
402407
if (ret)
403408
return ret;
@@ -1782,8 +1787,8 @@ static int btintel_pcie_alloc(struct btintel_pcie_data *data)
17821787
* + size of index * Number of queues(2) * type of index array(4)
17831788
* + size of context information
17841789
*/
1785-
total = (sizeof(struct tfd) + sizeof(struct urbd0) + sizeof(struct frbd)
1786-
+ sizeof(struct urbd1)) * BTINTEL_DESCS_COUNT;
1790+
total = (sizeof(struct tfd) + sizeof(struct urbd0)) * BTINTEL_PCIE_TX_DESCS_COUNT;
1791+
total += (sizeof(struct frbd) + sizeof(struct urbd1)) * BTINTEL_PCIE_RX_DESCS_COUNT;
17871792

17881793
/* Add the sum of size of index array and size of ci struct */
17891794
total += (sizeof(u16) * BTINTEL_PCIE_NUM_QUEUES * 4) + sizeof(struct ctx_info);
@@ -1808,36 +1813,36 @@ static int btintel_pcie_alloc(struct btintel_pcie_data *data)
18081813
data->dma_v_addr = v_addr;
18091814

18101815
/* Setup descriptor count */
1811-
data->txq.count = BTINTEL_DESCS_COUNT;
1812-
data->rxq.count = BTINTEL_DESCS_COUNT;
1816+
data->txq.count = BTINTEL_PCIE_TX_DESCS_COUNT;
1817+
data->rxq.count = BTINTEL_PCIE_RX_DESCS_COUNT;
18131818

18141819
/* Setup tfds */
18151820
data->txq.tfds_p_addr = p_addr;
18161821
data->txq.tfds = v_addr;
18171822

1818-
p_addr += (sizeof(struct tfd) * BTINTEL_DESCS_COUNT);
1819-
v_addr += (sizeof(struct tfd) * BTINTEL_DESCS_COUNT);
1823+
p_addr += (sizeof(struct tfd) * BTINTEL_PCIE_TX_DESCS_COUNT);
1824+
v_addr += (sizeof(struct tfd) * BTINTEL_PCIE_TX_DESCS_COUNT);
18201825

18211826
/* Setup urbd0 */
18221827
data->txq.urbd0s_p_addr = p_addr;
18231828
data->txq.urbd0s = v_addr;
18241829

1825-
p_addr += (sizeof(struct urbd0) * BTINTEL_DESCS_COUNT);
1826-
v_addr += (sizeof(struct urbd0) * BTINTEL_DESCS_COUNT);
1830+
p_addr += (sizeof(struct urbd0) * BTINTEL_PCIE_TX_DESCS_COUNT);
1831+
v_addr += (sizeof(struct urbd0) * BTINTEL_PCIE_TX_DESCS_COUNT);
18271832

18281833
/* Setup FRBD*/
18291834
data->rxq.frbds_p_addr = p_addr;
18301835
data->rxq.frbds = v_addr;
18311836

1832-
p_addr += (sizeof(struct frbd) * BTINTEL_DESCS_COUNT);
1833-
v_addr += (sizeof(struct frbd) * BTINTEL_DESCS_COUNT);
1837+
p_addr += (sizeof(struct frbd) * BTINTEL_PCIE_RX_DESCS_COUNT);
1838+
v_addr += (sizeof(struct frbd) * BTINTEL_PCIE_RX_DESCS_COUNT);
18341839

18351840
/* Setup urbd1 */
18361841
data->rxq.urbd1s_p_addr = p_addr;
18371842
data->rxq.urbd1s = v_addr;
18381843

1839-
p_addr += (sizeof(struct urbd1) * BTINTEL_DESCS_COUNT);
1840-
v_addr += (sizeof(struct urbd1) * BTINTEL_DESCS_COUNT);
1844+
p_addr += (sizeof(struct urbd1) * BTINTEL_PCIE_RX_DESCS_COUNT);
1845+
v_addr += (sizeof(struct urbd1) * BTINTEL_PCIE_RX_DESCS_COUNT);
18411846

18421847
/* Setup data buffers for txq */
18431848
err = btintel_pcie_setup_txq_bufs(data, &data->txq);

‎drivers/bluetooth/btintel_pcie.h‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,11 @@ enum msix_mbox_int_causes {
154154
/* Default interrupt timeout in msec */
155155
#define BTINTEL_DEFAULT_INTR_TIMEOUT_MS 3000
156156

157-
/* The number of descriptors in TX/RX queues */
158-
#define BTINTEL_DESCS_COUNT 16
157+
/* The number of descriptors in TX queues */
158+
#define BTINTEL_PCIE_TX_DESCS_COUNT 32
159+
160+
/* The number of descriptors in RX queues */
161+
#define BTINTEL_PCIE_RX_DESCS_COUNT 64
159162

160163
/* Number of Queue for TX and RX
161164
* It indicates the index of the IA(Index Array)
@@ -177,9 +180,6 @@ enum {
177180
/* Doorbell vector for TFD */
178181
#define BTINTEL_PCIE_TX_DB_VEC 0
179182

180-
/* Number of pending RX requests for downlink */
181-
#define BTINTEL_PCIE_RX_MAX_QUEUE 6
182-
183183
/* Doorbell vector for FRBD */
184184
#define BTINTEL_PCIE_RX_DB_VEC 513
185185

‎include/net/bluetooth/hci_core.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -546,6 +546,7 @@ struct hci_dev {
546546
struct hci_conn_hash conn_hash;
547547

548548
struct list_head mesh_pending;
549+
struct mutex mgmt_pending_lock;
549550
struct list_head mgmt_pending;
550551
struct list_head reject_list;
551552
struct list_head accept_list;
@@ -2400,7 +2401,6 @@ void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev,
24002401
u8 instance);
24012402
void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev,
24022403
u8 instance);
2403-
void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle);
24042404
int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip);
24052405
void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle,
24062406
bdaddr_t *bdaddr, u8 addr_type);

‎net/bluetooth/hci_core.c‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1877,10 +1877,8 @@ void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
18771877
if (monitor->handle)
18781878
idr_remove(&hdev->adv_monitors_idr, monitor->handle);
18791879

1880-
if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1880+
if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED)
18811881
hdev->adv_monitors_cnt--;
1882-
mgmt_adv_monitor_removed(hdev, monitor->handle);
1883-
}
18841882

18851883
kfree(monitor);
18861884
}
@@ -2487,6 +2485,7 @@ struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
24872485

24882486
mutex_init(&hdev->lock);
24892487
mutex_init(&hdev->req_lock);
2488+
mutex_init(&hdev->mgmt_pending_lock);
24902489

24912490
ida_init(&hdev->unset_handle_ida);
24922491

@@ -3417,23 +3416,18 @@ static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
34173416

34183417
bt_dev_err(hdev, "link tx timeout");
34193418

3420-
rcu_read_lock();
3419+
hci_dev_lock(hdev);
34213420

34223421
/* Kill stalled connections */
3423-
list_for_each_entry_rcu(c, &h->list, list) {
3422+
list_for_each_entry(c, &h->list, list) {
34243423
if (c->type == type && c->sent) {
34253424
bt_dev_err(hdev, "killing stalled connection %pMR",
34263425
&c->dst);
3427-
/* hci_disconnect might sleep, so, we have to release
3428-
* the RCU read lock before calling it.
3429-
*/
3430-
rcu_read_unlock();
34313426
hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3432-
rcu_read_lock();
34333427
}
34343428
}
34353429

3436-
rcu_read_unlock();
3430+
hci_dev_unlock(hdev);
34373431
}
34383432

34393433
static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,

0 commit comments

Comments
 (0)