fix memory leak in fixed btusb_close

fix memory leak in fixed btusb_close

[Oliver Neukum]

If the waker is killed before it can replay outstanding URBs,
these URBs won't be freed or will be replayed at the next open.
This patch closes the window by explicitely discarding outstanding
URBs.

Signed-off-by: Oliver Neukum <oliver@neukum.org>

Rafael, could you test this just to make sure? I don't want to screw
up the same driver twice.

	Regards
		Oliver

--

commit 8a3e793888c75bc7a49ff8b0be7ec6bd5438d985
Author: Oliver Neukum <oliver@neukum.org>
Date:   Thu Nov 12 16:41:46 2009 +0100

    btusb: close race in disconnect leading to a memory leak
    
    if the waker work is cancelled any deferred IO must be discarded
    in close to free the memory and make sure the data isn't replayed
    later

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2fb3802..44bc8bb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -600,11 +600,13 @@ static int btusb_close(struct hci_dev *hdev)
 	btusb_stop_traffic(data);
 	err = usb_autopm_get_interface(data->intf);
 	if (err < 0)
-		return 0;
+		goto failed;
 
 	data->intf->needs_remote_wakeup = 0;
 	usb_autopm_put_interface(data->intf);
 
+failed:
+	usb_scuttle_anchored_urbs(&data->deferred);
 	return 0;
 }
 

Re: fix memory leak in fixed btusb_close

[Rafael J. Wysocki]

On Thursday 12 November 2009, Oliver Neukum wrote:
> If the waker is killed before it can replay outstanding URBs,
> these URBs won't be freed or will be replayed at the next open.
> This patch closes the window by explicitely discarding outstanding
> URBs.
> 
> Signed-off-by: Oliver Neukum <oliver@neukum.org>
> 
> Rafael, could you test this just to make sure? I don't want to screw
> up the same driver twice.

It doesn't appear to kill the box right away and I have no traces of failure
in the logs after several consecutive suspend-resume cycles.

Thanks,
Rafael

Re: fix memory leak in fixed btusb_close

[Marcel Holtmann]

Hi Oliver,

> If the waker is killed before it can replay outstanding URBs,
> these URBs won't be freed or will be replayed at the next open.
> This patch closes the window by explicitely discarding outstanding
> URBs.
> 
> Signed-off-by: Oliver Neukum <oliver@neukum.org>

Acked-by: Marcel Holtmann <marcel@holtmann.org>

> Rafael, could you test this just to make sure? I don't want to screw
> up the same driver twice.

Feel free to send this directly to Linus for inclusion.

Regards

Marcel

Re: fix memory leak in fixed btusb_close

[Oliver Neukum]

Am Freitag, 13. November 2009 04:08:20 schrieb Marcel Holtmann:
> Hi Oliver,
> 
> > If the waker is killed before it can replay outstanding URBs,
> > these URBs won't be freed or will be replayed at the next open.
> > This patch closes the window by explicitely discarding outstanding
> > URBs.
> >
> > Signed-off-by: Oliver Neukum <oliver@neukum.org>
> 
> Acked-by: Marcel Holtmann <marcel@holtmann.org>
> 
> > Rafael, could you test this just to make sure? I don't want to screw
> > up the same driver twice.
> 
> Feel free to send this directly to Linus for inclusion.

This late in the RCs?

	Regards
		Oliver

Re: fix memory leak in fixed btusb_close

[Marcel Holtmann]

Hi Oliver,

> > > If the waker is killed before it can replay outstanding URBs,
> > > these URBs won't be freed or will be replayed at the next open.
> > > This patch closes the window by explicitely discarding outstanding
> > > URBs.
> > >
> > > Signed-off-by: Oliver Neukum <oliver@neukum.org>
> > 
> > Acked-by: Marcel Holtmann <marcel@holtmann.org>
> > 
> > > Rafael, could you test this just to make sure? I don't want to screw
> > > up the same driver twice.
> > 
> > Feel free to send this directly to Linus for inclusion.
> 
> This late in the RCs?

he can decide not to take it if chooses, but from my point of view it
worth fixing.

Regards

Marcel