From patchwork Sat Jul 16 04:30:21 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gustavo F. Padovan" X-Patchwork-Id: 104931 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 0CFDDB6F75 for ; Sat, 16 Jul 2011 14:31:25 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751513Ab1GPEbP (ORCPT ); Sat, 16 Jul 2011 00:31:15 -0400 Received: from mail-qw0-f46.google.com ([209.85.216.46]:35522 "EHLO mail-qw0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751110Ab1GPEbO (ORCPT ); Sat, 16 Jul 2011 00:31:14 -0400 Received: by qwk3 with SMTP id 3so865498qwk.19 for ; Fri, 15 Jul 2011 21:31:13 -0700 (PDT) Received: by 10.224.217.7 with SMTP id hk7mr3573621qab.59.1310790673031; Fri, 15 Jul 2011 21:31:13 -0700 (PDT) Received: from localhost.localdomain ([187.106.45.62]) by mx.google.com with ESMTPS id o4sm1308165qct.25.2011.07.15.21.31.02 (version=TLSv1/SSLv3 cipher=OTHER); Fri, 15 Jul 2011 21:31:12 -0700 (PDT) From: "Gustavo F. Padovan" To: davem@davemloft.net Cc: linville@tuxdriver.com, netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org, Ilia Kolomisnky Subject: [PATCH 2/2] Bluetooth: Fix crash with incoming L2CAP connections Date: Sat, 16 Jul 2011 01:30:21 -0300 Message-Id: <1310790621-28510-3-git-send-email-padovan@profusion.mobi> X-Mailer: git-send-email 1.7.6 In-Reply-To: <1310790621-28510-2-git-send-email-padovan@profusion.mobi> References: <1310790621-28510-1-git-send-email-padovan@profusion.mobi> <1310790621-28510-2-git-send-email-padovan@profusion.mobi> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Ilia Kolomisnky Another regression fix considering incomming l2cap connections with defer_setup enabled. In situations when incomming connection is extracted with l2cap_sock_accept, it's bt_sock info will have 'parent' member zerroed, but 'parent' may be used unconditionally in l2cap_conn_start() and l2cap_security_cfm() when defer_setup is enabled. Backtrace: [] (l2cap_security_cfm+0x0/0x2ac [bluetooth]) from [] (hci_event_pac ket+0xc2c/0x4aa4 [bluetooth]) [] (hci_event_packet+0x0/0x4aa4 [bluetooth]) from [] (hci_rx_task+0x cc/0x27c [bluetooth]) [] (hci_rx_task+0x0/0x27c [bluetooth]) from [] (tasklet_action+0xa0/ 0x15c) [] (tasklet_action+0x0/0x15c) from [] (__do_softirq+0x98/0x130) r7:00000101 r6:00000018 r5:00000001 r4:efc46000 [] (__do_softirq+0x0/0x130) from [] (do_softirq+0x4c/0x58) [] (do_softirq+0x0/0x58) from [] (run_ksoftirqd+0xb0/0x1b4) r4:efc46000 r3:00000001 [] (run_ksoftirqd+0x0/0x1b4) from [] (kthread+0x84/0x8c) r7:00000000 r6:c008f530 r5:efc47fc4 r4:efc41f08 [] (kthread+0x0/0x8c) from [] (do_exit+0x0/0x5f0) Signed-off-by: Ilia Kolomisnky Signed-off-by: Gustavo F. Padovan --- net/bluetooth/l2cap_core.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 4fbf67e..7705e26 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -620,7 +620,8 @@ static void l2cap_conn_start(struct l2cap_conn *conn) struct sock *parent = bt_sk(sk)->parent; rsp.result = cpu_to_le16(L2CAP_CR_PEND); rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); - parent->sk_data_ready(parent, 0); + if (parent) + parent->sk_data_ready(parent, 0); } else { sk->sk_state = BT_CONFIG; @@ -4009,7 +4010,8 @@ static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) struct sock *parent = bt_sk(sk)->parent; res = L2CAP_CR_PEND; stat = L2CAP_CS_AUTHOR_PEND; - parent->sk_data_ready(parent, 0); + if (parent) + parent->sk_data_ready(parent, 0); } else { sk->sk_state = BT_CONFIG; res = L2CAP_CR_SUCCESS;