Re: [PATCH v3 0/3] Bluetooth: SMP: Serialize root channel updates

[Luiz Augusto von Dentz]

Hi Cen,

On Sat, Oct 31, 2026 at 3:32 AM Cen Zhang <zzzccc427@xxxxxxxxx> wrote:
>
> The SMP root channels in hdev->smp_data and hdev->smp_bredr_data are
> used by HCI event processing under hdev->lock and by SMP receive
> callbacks on hdev->workqueue. Power-off already removes them under
> hdev->lock in hci_dev_close_sync(). Two other writers do not serialize
> with these users:
>
>   1/3 The force_bredr_smp debugfs switch creates and removes the BR/EDR
>       root without hdev->lock. A connection confirmation can see a root
>       whose operations are not set yet, and a disable can race with
>       power-off and release the channel twice. Take hdev->lock in the
>       writer, and skip the deletion when power-off already emptied the
>       slot.
>
>   3/3 smp_register() replaces both roots when management powers on a
>       controller that is already up with HCI_AUTO_OFF set, while HCI
>       event processing and SMP receive callbacks can still be using the
>       old roots. Run the registration on hdev->workqueue, where it ran
>       before commit 2ff13894cfb8 ("Bluetooth: Perform HCI update for
>       power on synchronously"), and hold hdev->lock while it replaces
>       the roots. The caller waits for the work with the request lock
>       held but not hdev->lock, which HCI event processing on that
>       workqueue takes.
>
> Patch 2/3 makes that hold for every caller: hci_power_on() runs the same
> power-on update for a controller in the HCI_AUTO_OFF window, but has
> done so without the request lock since commit cf75ad8b41d2 ("Bluetooth:
> hci_sync: Convert MGMT_SET_POWERED").
>
> smp_register() still warns when it replaces the channels on that path.
> This series only makes the replacement safe.
>
> Cen Zhang (3):
>   Bluetooth: SMP: Serialize forced BR/EDR channel changes
>   Bluetooth: hci_core: Hold the request lock for the power-on update
>   Bluetooth: SMP: Serialize root channel replacement
>
>  net/bluetooth/hci_core.c    |  3 +++
>  net/bluetooth/hci_debugfs.c |  2 ++
>  net/bluetooth/smp.c         | 38 +++++++++++++++++++++++++++++++++++--
>  net/bluetooth/smp.h         |  3 ++-
>  4 files changed, 43 insertions(+), 3 deletions(-)
>
> ---
> Changes in v3:
> - Address the hci_power_on() path that reaches smp_register() without the
>   request lock, raised by Sashiko: https://sashiko.dev/#/patchset/99158
> - Add patch 2, which takes the request lock in hci_power_on() again, and
>   correct the locking description of patch 3; the code of patches 1 and 3 is
>   unchanged.
>
> Changes in v2:
> - Address the CheckPatch and GitLint long-line failures reported by the
>   Bluetooth CI: https://patchwork.kernel.org/series/1197223/
> - Trim the crash reports in both commit messages to the headline, call trace
>   and allocation/free stacks; no code changes.
>
> Link to v1: https://lore.kernel.org/r/pm-bluetooth-objects-candidate-0184-v7-c26e53b52c260063ab6a-0@xxxxxxxxx
> Link to v2: https://lore.kernel.org/r/pm-bluetooth-objects-candidate-0184-v8-60106ad0c49170f5bfb4-0@xxxxxxxxx

netdev sashiko instance found a couple of problems with this one:
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/pm-bluetooth-objects-candidate-0184-v9-4094fa28af7bd56a283a-0%40gmail.com

-- 
Luiz Augusto von Dentz