Bug#992121: linux-image-5.10.0-8-amd64: kernel oops and subsequent hard crash in bluetooth bt_sock_poll, regression, upstream patch

[Salvatore Bonaccorso <carnil@debian.org>]

Control: tags -1 + moreinfo

Hi Tim,

On Thu, Aug 12, 2021 at 02:32:52PM +1000, Tim Connors wrote:
> Package: src:linux
> Version: 5.10.46-4
> Severity: important
> Tags: patch
> 
> Looks like debian stable is going to get a kernel that crashes a few
> minutes after you start using bluetooth for audio streaming to
> headphones!
> 
> Happened a couple of times, within a few minutes of starting to use
> bluetooth.  First time, didn't get any syslogs.  Machine was hard
> locked for 30 minutes, only responded to alt-sysrq-s,u,b (sysrq didn't
> otherwise log anything).
> 
> Second time, got a crash in bt_sock_poll, plenty of things still got
> logged to syslog until I rebooted, but the machine was otherwise
> unusable - X deadlocked, and ssh not responding.  If it's the same
> crash every time, that pretty much makes bluetooth audio streaming
> unusable on this machine.
> 
> https://www.spinics.net/lists/linux-bluetooth/msg88356.html
> 
> points to a patch that has supposedly already been applied to
> bluetooth-next, but is definitely not in linux-source-5.10 5.10.46-4
> (testing).
> 
> Current code still reads:
> 
>         /* cleanup runtime environment */
>         remove_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
>         remove_wait_queue(sk_sleep(session->intr_sock->sk), &ctrl_wait);
>         wake_up_interruptible(&session->report_queue);
>         hidp_del_timer(session);
> 
> Second remove_wait_queue should be: ctrl_sock->sk

Would it be possible that you check if the upstream commit
https://git.kernel.org/linus/cca342d98bef68151a80b024f7bf5f388d1fbdea
fixes the issue?

It was not yet queued for the 5.10.y series, but if yes, this should
go to stable@ so that we then can pick it up for either cherry-picking
for the next bullseye upload (or a rebase to the latest 5.10.y in a
point release).

Regards,
Salvatore