From: Marcel Holtmann <marcel@holtmann.org>
To: Emeltchenko Andrei <Andrei.Emeltchenko.news@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Subject: Re: [RESEND 2/3] Bluetooth: Use list _safe deleting from conn_hash_list
Date: Tue, 31 Jan 2012 07:07:42 -0800 [thread overview]
Message-ID: <1328022462.1955.213.camel@aeonflux> (raw)
In-Reply-To: <1327999384-16094-3-git-send-email-Andrei.Emeltchenko.news@gmail.com>
Hi Andrei,
> Use list_for_each_entry_safe which is safe version against removal
> of list entry. Otherwise we remove hci_conn element and reference
> next element which result in accessing LIST_POISON.
>
> [ 95.571834] Bluetooth: unknown link type 127
> [ 95.578349] BUG: unable to handle kernel paging request at 20002000
> [ 95.580236] IP: [<20002000>] 0x20001fff
> [ 95.580763] *pde = 00000000
> [ 95.581196] Oops: 0000 [#1] SMP
> ...
> [ 95.582298] Pid: 3355, comm: hciconfig Tainted: G O 3.2.0-rc2niko+ #62 innotek GmbH VirtualBox
> [ 95.582298] EIP: 0060:[<20002000>] EFLAGS: 00210206 CPU: 0
> [ 95.582298] EIP is at 0x20002000
> [ 95.582298] EAX: ea4bc000 EBX: ea4bc000 ECX: 20002000 EDX: 00000016
> [ 95.582298] ESI: f49516f8 EDI: f4951008 EBP: ea4f1e6c ESP: ea4f1e50
> [ 95.582298] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
> [ 95.582298] Process hciconfig (pid: 3355, ti=ea4f0000 task=ea4a8000 task.ti=ea4f0000)
> [ 95.582298] Stack:
> [ 95.582298] f8231ab6 f825518d f8255178 0000007f ea4bc000 f4951000 f495163c ea4f1e98
> [ 95.582298] f822bcb1 f4951000 ea4f1e98 f822d679 0000000c f4951068 ea4a8000 f4951000
> [ 95.582298] ffffffed 00000000 ea4f1ea8 f822e1da 400448ca ea4f6800 ea4f1ee4 f824102f
> [ 95.582298] Call Trace:
> [ 95.582298] [<f8231ab6>] ? hci_conn_hash_flush+0x76/0xf0 [bluetooth]
> [ 95.582298] [<f822bcb1>] hci_dev_do_close+0xc1/0x2e0 [bluetooth]
> [ 95.582298] [<f822d679>] ? hci_dev_get+0x69/0xb0 [bluetooth]
> [ 95.582298] [<f822e1da>] hci_dev_close+0x2a/0x50 [bluetooth]
> [ 95.582298] [<f824102f>] hci_sock_ioctl+0x1af/0x3f0 [bluetooth]
> [ 95.582298] [<c11153ea>] ? handle_pte_fault+0x8a/0x8f0
> [ 95.582298] [<c146becf>] sock_ioctl+0x5f/0x260
> [ 95.582298] [<c146be70>] ? sock_fasync+0x90/0x90
> [ 95.582298] [<c1152b33>] do_vfs_ioctl+0x83/0x5b0
> [ 95.582298] [<c1563f87>] ? do_page_fault+0x297/0x500
> [ 95.582298] [<c1563cf0>] ? spurious_fault+0xd0/0xd0
> [ 95.582298] [<c107165b>] ? up_read+0x1b/0x30
> [ 95.582298] [<c1563f87>] ? do_page_fault+0x297/0x500
> [ 95.582298] [<c100aa9f>] ? init_fpu+0xef/0x160
> [ 95.582298] [<c15617c0>] ? do_debug+0x180/0x180
> [ 95.582298] [<c100a958>] ? fpu_finit+0x28/0x80
> [ 95.582298] [<c11530e7>] sys_ioctl+0x87/0x90
> [ 95.582298] [<c156795f>] sysenter_do_call+0x12/0x38
> ...
>
> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
> ---
> net/bluetooth/hci_conn.c | 4 ++--
> 1 files changed, 2 insertions(+), 2 deletions(-)
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Regards
Marcel
next prev parent reply other threads:[~2012-01-31 15:07 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-31 8:43 [RESEND 0/3] Fixes kernel crashes and warnings Emeltchenko Andrei
2012-01-31 8:43 ` [RESEND 1/3] Bluetooth: Use cancel_work instead of cancel_work_sync Emeltchenko Andrei
2012-01-31 12:31 ` Andre Guedes
2012-01-31 13:02 ` Emeltchenko Andrei
2012-01-31 15:11 ` Marcel Holtmann
2012-01-31 15:41 ` Ulisses Furquim
2012-01-31 15:58 ` Marcel Holtmann
2012-01-31 17:49 ` Ulisses Furquim
2012-02-01 13:32 ` Emeltchenko Andrei
2012-02-01 15:53 ` Marcel Holtmann
2012-02-02 8:34 ` Emeltchenko Andrei
2012-01-31 15:07 ` Marcel Holtmann
2012-01-31 8:43 ` [RESEND 2/3] Bluetooth: Use list _safe deleting from conn_hash_list Emeltchenko Andrei
2012-01-31 15:07 ` Marcel Holtmann [this message]
2012-01-31 8:43 ` [RESEND 3/3] Bluetooth: Use list _safe deleting from conn chan_list Emeltchenko Andrei
2012-01-31 15:08 ` Marcel Holtmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1328022462.1955.213.camel@aeonflux \
--to=marcel@holtmann.org \
--cc=Andrei.Emeltchenko.news@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox