linux-kernel - Re: [PATCH] bluetooth : move children of connection device to NULL before connection down

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20080124012601.GA2982@darkstar.te-china.tietoenator.com>
Date:	Thu, 24 Jan 2008 09:26:01 +0800
From:	Dave Young <hidave.darkstar@...il.com>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Marcel Holtmann <marcel@...tmann.org>, davem@...emloft.net,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	bluez-devel@...ts.sourceforge.net, cornelia.huck@...ibm.com,
	gombasg@...aki.hu, htejun@...il.com, viro@...iv.linux.org.uk,
	kay.sievers@...y.org, greg@...ah.com
Subject: Re: [PATCH] bluetooth : move children of connection device to NULL
	before connection down

On Thu, Jan 24, 2008 at 09:19:26AM +0800, Dave Young wrote:
> On Wed, Jan 23, 2008 at 02:06:29PM -0800, Andrew Morton wrote:
> > > On Tue, 22 Jan 2008 07:18:16 +0100 Marcel Holtmann <marcel@...tmann.org> wrote:
> > > Hi Dave,
> > > 
> > > > > Add people missed in cc-list.
> > > > 
> > > > Thanks Dave for your continued efforts on Bluetooth bugs like this.
> > > > 
> > > > Marcel, are you going to review/ACK/integrate/push-upstream/whatever
> > > > any of these Bluetooth patches?
> > > > 
> > > > It hasn't been getting much love from you as of late, you are one of
> > > > the listed maintainers, and I don't want to lose any of Dave's
> > > > valuable bug fixing work.
> > > 
> > > I will be fully back in business next week. Just got stuck in a project
> > > that needed 200% of my time to get it going.
> > >
> > 
> > These patches in -mm:
> > 
> > bluetooth-hidp_process_hid_control-remove-unnecessary-parameter-dealing.patch
> > bluetooth-uninlining.patch
> > drivers-bluetooth-bpa10xc-fix-memleak.patch
> > drivers-bluetooth-btsdioc-fix-double-free.patch
> > bluetooth-blacklist-another-broadcom-bcm2035-device.patch
> > bluetooth-rfcomm-tty_close-before-destruct.patch
> > hci_ldisc-fix-null-pointer-deref.patch
> > 
> > could benefit from some attention please.
> 
> Hi, andrew
> 
> For the patch bluetooth-rfcomm-tty_close-before-destruct.patch I have to rethinkabout it.
> 
> 1. The subject is not correct, should be rfcomm-tty-destroy-before-tty_close.
> 2. Don't know what I was thinking that time, could you replace it with the following better one? Sorry for that.
> 
> ---
> rfcomm dev could be deleted in tty_hangup, so we must not call rfcomm_dev_del again to prevent from destroying rfcomm dev before tty close.
> 
> Signed-off-by: Dave Young <hidave.darkstar@...il.com> 
> 
> ---
>  net/bluetooth/rfcomm/tty.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> diff -upr a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
> --- a/net/bluetooth/rfcomm/tty.c	2008-01-24 09:03:59.000000000 +0800
> +++ b/net/bluetooth/rfcomm/tty.c	2008-01-24 09:03:59.000000000 +0800
> @@ -429,6 +429,8 @@ static int rfcomm_release_dev(void __use
>  	if (dev->tty)
>  		tty_vhangup(dev->tty);
>  
> +	if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
> +		rfcomm_dev_del(dev);
>  	rfcomm_dev_del(dev);
	~~~~~~~~~~~~~~~~~
>  	rfcomm_dev_put(dev);
>  	return 0;

Please ignore the previous silly one, now resubmit :
----------

rfcomm dev could be deleted in tty_hangup, so we must not call rfcomm_dev_del again to prevent from destroying rfcomm dev before tty close.

Signed-off-by: Dave Young <hidave.darkstar@...il.com> 

---
 net/bluetooth/rfcomm/tty.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff -upr a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
--- a/net/bluetooth/rfcomm/tty.c	2008-01-24 09:21:56.000000000 +0800
+++ b/net/bluetooth/rfcomm/tty.c	2008-01-24 09:21:56.000000000 +0800
@@ -429,7 +429,8 @@ static int rfcomm_release_dev(void __use
 	if (dev->tty)
 		tty_vhangup(dev->tty);
 
-	rfcomm_dev_del(dev);
+	if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
+		rfcomm_dev_del(dev);
 	rfcomm_dev_put(dev);
 	return 0;
 }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/