Bug#992121: linux-image-5.10.0-8-amd64: kernel oops and subsequent hard crash in bluetooth bt_sock_poll, regression, upstream patch

[Salvatore Bonaccorso]

Control: tags -1 + moreinfo

Hi Tim,

On Thu, Aug 12, 2021 at 02:32:52PM +1000, Tim Connors wrote:
> Package: src:linux
> Version: 5.10.46-4
> Severity: important
> Tags: patch
>
> Looks like debian stable is going to get a kernel that crashes a few
> minutes after you start using bluetooth for audio streaming to
> headphones!
>
> Happened a couple of times, within a few minutes of starting to use
> bluetooth. First time, didn't get any syslogs. Machine was hard
> locked for 30 minutes, only responded to alt-sysrq-s,u,b (sysrq didn't
> otherwise log anything).
>
> Second time, got a crash in bt_sock_poll, plenty of things still got
> logged to syslog until I rebooted, but the machine was otherwise
> unusable - X deadlocked, and ssh not responding. If it's the same
> crash every time, that pretty much makes bluetooth audio streaming
> unusable on this machine.
>
> https://www.spinics.net/lists/linux-bluetooth/msg88356.html
>
> points to a patch that has supposedly already been applied to
> bluetooth-next, but is definitely not in linux-source-5.10 5.10.46-4
> (testing).
>
> Current code still reads:
>
> /* cleanup runtime environment */
> remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
> remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
> wake_up_interruptible(&session->report_queue);
> hidp_del_timer(session);
>
> Second remove_wait_queue should be: ctrl_sock->sk

Would it be possible that you check if the upstream commit
https://git.kernel.org/linus/cca342d98bef68151a80b024f7bf5f388d1fbdea
fixes the issue?

It was not yet queued for the 5.10.y series, but if yes, this should
go to stable@ so that we then can pick it up for either cherry-picking
for the next bullseye upload (or a rebase to the latest 5.10.y in a
point release).

Regards,
Salvatore

[Tim Connors]

On Thu, 12 Aug 2021, Salvatore Bonaccorso wrote:

> > https://www.spinics.net/lists/linux-bluetooth/msg88356.html
> >
> > points to a patch that has supposedly already been applied to
> > bluetooth-next, but is definitely not in linux-source-5.10 5.10.46-4
> > (testing).
> >
> > Current code still reads:
> >
> > /* cleanup runtime environment */
> > remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
> > remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
> > wake_up_interruptible(&session->report_queue);
> > hidp_del_timer(session);
> >
> > Second remove_wait_queue should be: ctrl_sock->sk
>
> Would it be possible that you check if the upstream commit
> https://git.kernel.org/linus/cca342d98bef68151a80b024f7bf5f388d1fbdea
> fixes the issue?
>
> It was not yet queued for the 5.10.y series, but if yes, this should
> go to stable@ so that we then can pick it up for either cherry-picking
> for the next bullseye upload (or a rebase to the latest 5.10.y in a
> point release).

I've been running it for a few days now, and it seems good to me!

--
Tim Connors

[Salvatore Bonaccorso]

Hi Tim,

Thanks! I asked if this can be included in future 5.10.y stable
update so that we can pick it up:

https://lore.kernel.org/stable/YR+9P8Na...@eldamar.lan/T/#u

Regards,
Salvatore