[PATCH] Bluetooth: Really fix registering hci with duplicate name

[Sasha Levin]

Commit fc50744 ("Bluetooth: Fix registering hci with duplicate name") didn't
fully fix the duplicate naming issue with devices, and duplicate device names
could still be created:

[ 142.484097] device: 'hci1': device_add
[...]
[ 150.545263] device: 'hci1': device_add
[ 150.550128] kobject: 'hci1' (ffff880014cc4e58): kobject_add_internal: parent: 'bluetooth', set: 'devices'
[ 150.558979] ------------[ cut here ]------------
[ 150.561438] WARNING: at fs/sysfs/dir.c:529 sysfs_add_one+0xb0/0xd0()
[ 150.572974] Hardware name: Bochs
[ 150.580502] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1'
[ 150.584444] Pid: 7563, comm: trinity-child1 Tainted: G W 3.4.0-next-20120524-sasha #296
[...]

Instead of the weird logic and the attempt at keeping the device list sorted,
just use an IDA.

Signed-off-by: Sasha Levin <levins...@gmail.com>
---
net/bluetooth/hci_core.c | 30 ++++++++++++++++--------------
1 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 9c586fb..eca6dd1 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -26,6 +26,7 @@
/* Bluetooth HCI core. */

#include <linux/export.h>
+#include <linux/idr.h>

#include <linux/rfkill.h>

@@ -46,6 +47,9 @@ DEFINE_RWLOCK(hci_dev_list_lock);
LIST_HEAD(hci_cb_list);
DEFINE_RWLOCK(hci_cb_list_lock);

+/* HCI ID Numbering */
+static DEFINE_IDA(hci_index_ida);
+
/* ---- HCI notifications ---- */

static void hci_notify(struct hci_dev *hdev, int event)
@@ -1689,7 +1693,6 @@ EXPORT_SYMBOL(hci_free_dev);
/* Register HCI device */
int hci_register_dev(struct hci_dev *hdev)
{
- struct list_head *head, *p;
int id, error;

if (!hdev->open || !hdev->close)
@@ -1701,25 +1704,19 @@ int hci_register_dev(struct hci_dev *hdev)
* so the index can be used as the AMP controller ID.
*/
id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
- head = &hci_dev_list;

- /* Find first available device id */
- list_for_each(p, &hci_dev_list) {
- int nid = list_entry(p, struct hci_dev, list)->id;
- if (nid > id)
- break;
- if (nid == id)
- id++;
- head = p;
- }
+ error = ida_simple_get(&hci_index_ida, id, 0, GFP_KERNEL);
+ if (error < 0)
+ return error;

+ id = error;
sprintf(hdev->name, "hci%d", id);
hdev->id = id;

BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

- list_add(&hdev->list, head);
-
+ write_lock(&hci_dev_list_lock);
+ list_add(&hdev->list, &hci_dev_list);
write_unlock(&hci_dev_list_lock);

hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
@@ -1755,6 +1752,7 @@ int hci_register_dev(struct hci_dev *hdev)
err_wqueue:
destroy_workqueue(hdev->workqueue);
err:
+ ida_simple_remove(&hci_index_ida, hdev->id);
write_lock(&hci_dev_list_lock);
list_del(&hdev->list);
write_unlock(&hci_dev_list_lock);
@@ -1766,12 +1764,14 @@ EXPORT_SYMBOL(hci_register_dev);
/* Unregister HCI device */
void hci_unregister_dev(struct hci_dev *hdev)
{
- int i;
+ int i, id;

BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

set_bit(HCI_UNREGISTER, &hdev->dev_flags);

+ id = hdev->id;
+
write_lock(&hci_dev_list_lock);
list_del(&hdev->list);
write_unlock(&hci_dev_list_lock);
@@ -1812,6 +1812,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
hci_dev_unlock(hdev);

hci_dev_put(hdev);
+
+ ida_simple_remove(&hci_index_ida, id);
}
EXPORT_SYMBOL(hci_unregister_dev);

--
1.7.8.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majo...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

[Marcel Holtmann]

Hi Sasha,

I do not really like this "error" thing here.

Why not something simple like this:

switch (hdev->dev_type) {
case HCI_BREDR:
id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
break;
case HCI_AMP:
id = ida_simple_get(&hci_index_idx, 1, 0, GFP_KERNEL);
break;
default:
return -EINVAL;
}

if (id < 0)
return id;

It would have the side effect to also check for valid dev_type at the
same time.

Or just just an extra variable start_id to avoid the "error" naming for
what is expected to be a positive result in almost all cases.

Regards

Marcel

[Sasha Levin]

Commit fc50744 ("Bluetooth: Fix registering hci with duplicate name") didn't
fully fix the duplicate naming issue with devices, and duplicate device names
could still be created:

[ 142.484097] device: 'hci1': device_add
[...]
[ 150.545263] device: 'hci1': device_add
[ 150.550128] kobject: 'hci1' (ffff880014cc4e58): kobject_add_internal: parent: 'bluetooth', set: 'devices'
[ 150.558979] ------------[ cut here ]------------
[ 150.561438] WARNING: at fs/sysfs/dir.c:529 sysfs_add_one+0xb0/0xd0()
[ 150.572974] Hardware name: Bochs
[ 150.580502] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1'
[ 150.584444] Pid: 7563, comm: trinity-child1 Tainted: G W 3.4.0-next-20120524-sasha #296
[...]

Instead of the weird logic and the attempt at keeping the device list sorted,
just use an IDA.

Signed-off-by: Sasha Levin <levins...@gmail.com>
---

Changes from v1:

- Address comments by Marcel.
- Remove errornous mutex lock.

net/bluetooth/hci_core.c | 41 ++++++++++++++++++++++++-----------------
1 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 9c586fb..440329b 100644

--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -26,6 +26,7 @@
/* Bluetooth HCI core. */

#include <linux/export.h>
+#include <linux/idr.h>

#include <linux/rfkill.h>

@@ -46,6 +47,9 @@ DEFINE_RWLOCK(hci_dev_list_lock);
LIST_HEAD(hci_cb_list);
DEFINE_RWLOCK(hci_cb_list_lock);

+/* HCI ID Numbering */
+static DEFINE_IDA(hci_index_ida);
+
/* ---- HCI notifications ---- */

static void hci_notify(struct hci_dev *hdev, int event)

@@ -1689,37 +1693,35 @@ EXPORT_SYMBOL(hci_free_dev);

/* Register HCI device */
int hci_register_dev(struct hci_dev *hdev)
{
- struct list_head *head, *p;
int id, error;

if (!hdev->open || !hdev->close)

return -EINVAL;

- write_lock(&hci_dev_list_lock);
-
/* Do not allow HCI_AMP devices to register at index 0,

* so the index can be used as the AMP controller ID.
*/

- id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;

- head = &hci_dev_list;
-
- /* Find first available device id */
- list_for_each(p, &hci_dev_list) {
- int nid = list_entry(p, struct hci_dev, list)->id;
- if (nid > id)
- break;
- if (nid == id)
- id++;
- head = p;

+ switch (hdev->dev_type) {
+ case HCI_BREDR:
+ id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
+ break;
+ case HCI_AMP:
+ id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
+ break;
+ default:
+ return -EINVAL;
}

+ if (id < 0)
+ return id;
+

sprintf(hdev->name, "hci%d", id);
hdev->id = id;

BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

- list_add(&hdev->list, head);
-
+ write_lock(&hci_dev_list_lock);
+ list_add(&hdev->list, &hci_dev_list);
write_unlock(&hci_dev_list_lock);

hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |

@@ -1755,6 +1757,7 @@ int hci_register_dev(struct hci_dev *hdev)

err_wqueue:
destroy_workqueue(hdev->workqueue);
err:
+ ida_simple_remove(&hci_index_ida, hdev->id);
write_lock(&hci_dev_list_lock);
list_del(&hdev->list);
write_unlock(&hci_dev_list_lock);

@@ -1766,12 +1769,14 @@ EXPORT_SYMBOL(hci_register_dev);

/* Unregister HCI device */
void hci_unregister_dev(struct hci_dev *hdev)
{
- int i;
+ int i, id;

BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

set_bit(HCI_UNREGISTER, &hdev->dev_flags);

+ id = hdev->id;
+
write_lock(&hci_dev_list_lock);
list_del(&hdev->list);
write_unlock(&hci_dev_list_lock);

@@ -1812,6 +1817,8 @@ void hci_unregister_dev(struct hci_dev *hdev)

hci_dev_unlock(hdev);

hci_dev_put(hdev);
+
+ ida_simple_remove(&hci_index_ida, id);
}
EXPORT_SYMBOL(hci_unregister_dev);

--
1.7.8.6

[Marcel Holtmann]

Hi Sasha,

> Commit fc50744 ("Bluetooth: Fix registering hci with duplicate name") didn't
> fully fix the duplicate naming issue with devices, and duplicate device names
> could still be created:
>
> [ 142.484097] device: 'hci1': device_add
> [...]
> [ 150.545263] device: 'hci1': device_add
> [ 150.550128] kobject: 'hci1' (ffff880014cc4e58): kobject_add_internal: parent: 'bluetooth', set: 'devices'
> [ 150.558979] ------------[ cut here ]------------
> [ 150.561438] WARNING: at fs/sysfs/dir.c:529 sysfs_add_one+0xb0/0xd0()
> [ 150.572974] Hardware name: Bochs
> [ 150.580502] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1'
> [ 150.584444] Pid: 7563, comm: trinity-child1 Tainted: G W 3.4.0-next-20120524-sasha #296
> [...]
>
> Instead of the weird logic and the attempt at keeping the device list sorted,
> just use an IDA.
>
> Signed-off-by: Sasha Levin <levins...@gmail.com>
> ---
>
> Changes from v1:
>
> - Address comments by Marcel.
> - Remove errornous mutex lock.
>
> net/bluetooth/hci_core.c | 41 ++++++++++++++++++++++++-----------------
> 1 files changed, 24 insertions(+), 17 deletions(-)

thanks for addressing this. Patch has been applied to bluetooth-next
tree.

Regards

Marcel

[Andrei Emeltchenko]

Hi,

The patch looks OK but I start to notice kmemleak messages like
shown below:

..
unreferenced object 0xf46e4ed8 (size 148):
comm "modprobe", pid 656, jiffies 4294900233 (age 4661.940s)
hex dump (first 32 bytes):
00 00 00 00 40 4e 6e f4 00 00 00 00 00 00 00 00 ....@Nn.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<c154dfcc>] kmemleak_alloc+0x3c/0xa0
[<c1132c7a>] kmem_cache_alloc+0x14a/0x190
[<c12af2dd>] idr_pre_get+0x5d/0x80
[<c12af3e5>] ida_pre_get+0x15/0x90
[<c12af497>] ida_simple_get+0x37/0xe0
[<f8369b79>] 0xf8369b79
[<f81be63e>] 0xf81be63e
[<c13f2a5e>] usb_probe_interface+0xce/0x210
[<c13733cb>] driver_probe_device+0x8b/0x370
[<c1373749>] __driver_attach+0x99/0xa0
[<c1371902>] bus_for_each_dev+0x42/0x70
[<c1372ea1>] driver_attach+0x21/0x30
[<c1372a47>] bus_add_driver+0x1c7/0x2e0
[<c1373bf6>] driver_register+0x66/0x110
[<c13f1acb>] usb_register_driver+0x7b/0x140
[<f8005017>] 0xf8005017
unreferenced object 0xf454c260 (size 148):
comm "modprobe", pid 656, jiffies 4294900233 (age 4661.940s)
hex dump (first 32 bytes):
00 00 00 00 d8 4e 6e f4 00 00 00 00 00 00 00 00 .....Nn.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<c154dfcc>] kmemleak_alloc+0x3c/0xa0
[<c1132c7a>] kmem_cache_alloc+0x14a/0x190
[<c12af2dd>] idr_pre_get+0x5d/0x80
[<c12af3e5>] ida_pre_get+0x15/0x90
[<c12af497>] ida_simple_get+0x37/0xe0
[<f8369b79>] 0xf8369b79
[<f81be63e>] 0xf81be63e
[<c13f2a5e>] usb_probe_interface+0xce/0x210
[<c13733cb>] driver_probe_device+0x8b/0x370
[<c1373749>] __driver_attach+0x99/0xa0
[<c1371902>] bus_for_each_dev+0x42/0x70
[<c1372ea1>] driver_attach+0x21/0x30
[<c1372a47>] bus_add_driver+0x1c7/0x2e0
[<c1373bf6>] driver_register+0x66/0x110
[<c13f1acb>] usb_register_driver+0x7b/0x140
[<f8005017>] 0xf8005017
..

Best regards
Andrei Emeltchenko