Skip to content

[PW_SID:1094429] Bluetooth: hci_core: Don't queue tx_work while draining workqueue#185

Open
BluezTestBot wants to merge 6 commits into
workflowfrom
1094429
Open

[PW_SID:1094429] Bluetooth: hci_core: Don't queue tx_work while draining workqueue#185
BluezTestBot wants to merge 6 commits into
workflowfrom
1094429

Conversation

@BluezTestBot
Copy link
Copy Markdown

Syzbot reported a warning when L2CAP calls queue_work() on the hdev
workqueue while it's being drained. This can happen during device reset or
close paths for hci_send_acl(), hci_send_sco() and hci_send_iso().

The workqueue is drained in hci_dev_do_reset() and in hci_dev_close_sync():

  • hci_dev_close_sync() clears the HCI_UP bit before draining
  • hci_dev_do_reset() sets HCI_CMD_DRAIN_WORKQUEUE before draining

Add these checks before queuing tx_work, and free the SKB if it's not
queued for transmission.

Fixes: 3eff45e ("Bluetooth: convert tx_task to workqueue")
Reported-by: syzbot+97721dd81f792e838ba0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=97721dd81f792e838ba0
Signed-off-by: Heitor Alves de Siqueira halves@igalia.com

net/bluetooth/hci_core.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)


base-commit: 1f63dd8ca0dc05a8272bb8155f643c691d29bb11
change-id: 20260513-hci_send-640290de7acc

Best regards,

Heitor Alves de Siqueira halves@igalia.com

tedd-an and others added 6 commits May 13, 2026 17:39
This patch adds workflow files for ci:

[sync.yml]
 - The workflow file for scheduled work
 - Sync the repo with upstream repo and rebase the workflow branch
 - Review the patches in the patchwork and creates the PR if needed

[ci.yml]
 - The workflow file for CI tasks
 - Run CI tests when PR is created

Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
This replaces the bzcafe action with bluez/action-ci so we can maintain
everything in the github bluez organization

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This attempts to sync every 5 minutes instead of 30.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
bluez/action-ci uses master as default branch for workflow which is
incorrect for kernel

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
The CI action now creates individual GitHub Check Runs per test, which
requires 'checks: write' permission on the GITHUB_TOKEN. Also make the
pull_request trigger types explicit to include 'reopened', allowing CI
to be retriggered by closing and reopening a PR.
Syzbot reported a warning when L2CAP calls queue_work() on the hdev
workqueue while it's being drained. This can happen during device reset or
close paths for hci_send_acl(), hci_send_sco() and hci_send_iso().

The workqueue is drained in hci_dev_do_reset() and in hci_dev_close_sync():
  - hci_dev_close_sync() clears the HCI_UP bit before draining
  - hci_dev_do_reset() sets HCI_CMD_DRAIN_WORKQUEUE before draining

Add these checks before queuing tx_work, and free the SKB if it's not
queued for transmission.

Fixes: 3eff45e ("Bluetooth: convert tx_task to workqueue")
Reported-by: syzbot+97721dd81f792e838ba0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=97721dd81f792e838ba0
Signed-off-by: Heitor Alves de Siqueira <halves@igalia.com>
@github-actions
Copy link
Copy Markdown

CheckPatch
Desc: Run checkpatch.pl script
Duration: 0.74 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

GitLint
Desc: Run gitlint
Duration: 0.34 seconds
Result: FAIL
Output:

Bluetooth: hci_core: Don't queue tx_work while draining workqueue

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
27: B2 Line has trailing whitespace: "--  "

@github-actions
Copy link
Copy Markdown

SubjectPrefix
Desc: Check subject contains "Bluetooth" prefix
Duration: 0.22 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

BuildKernel
Desc: Build Kernel for Bluetooth
Duration: 25.24 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

CheckAllWarning
Desc: Run linux kernel with all warning enabled
Duration: 27.80 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

CheckSparse
Desc: Run sparse tool with linux kernel
Duration: 26.72 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

BuildKernel32
Desc: Build 32bit Kernel for Bluetooth
Duration: 24.56 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunnerSetup
Desc: Setup kernel and bluez for test-runner
Duration: 528.86 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_l2cap-tester
Desc: Run l2cap-tester with test-runner
Duration: 374.94 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_iso-tester
Desc: Run iso-tester with test-runner
Duration: 604.66 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_bnep-tester
Desc: Run bnep-tester with test-runner
Duration: 19.00 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_mgmt-tester
Desc: Run mgmt-tester with test-runner
Duration: 2024.13 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_rfcomm-tester
Desc: Run rfcomm-tester with test-runner
Duration: 63.77 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_sco-tester
Desc: Run sco-tester with test-runner
Duration: 141.62 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_ioctl-tester
Desc: Run ioctl-tester with test-runner
Duration: 134.21 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_mesh-tester
Desc: Run mesh-tester with test-runner
Duration: 59.93 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_smp-tester
Desc: Run smp-tester with test-runner
Duration: 18.06 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_userchan-tester
Desc: Run userchan-tester with test-runner
Duration: 19.33 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

TestRunner_6lowpan-tester
Desc: Run 6lowpan-tester with test-runner
Duration: 51.00 seconds
Result: PASS

@github-actions
Copy link
Copy Markdown

IncrementalBuild
Desc: Incremental build with the patches in the series
Duration: 24.65 seconds
Result: PASS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants