From: Mathias Hasselmann <mathias.hasselmann@kdab.com>
To: Dean Jenkins <Dean_Jenkins@mentor.com>
Cc: Gianluca Anzolin <gianluca@sottospazio.it>,
marcel@holtmann.org, gustavo@padovan.org,
linux-bluetooth@vger.kernel.org
Subject: Re: [PATCH 1/2] Fix tty refcounting in rfcomm/tty.c
Date: Wed, 10 Jul 2013 10:39:21 +0200 [thread overview]
Message-ID: <1373445561.4594.21.camel@smarty> (raw)
In-Reply-To: <51DD1897.5020408@mentor.com>
Am Mittwoch, den 10.07.2013, 09:17 +0100 schrieb Dean Jenkins:
> Hi Gianluca,
>
> On 09/07/13 18:05, Gianluca Anzolin wrote:
> > In net/bluetooth/rfcomm/tty.c the struct tty is used without proper
> > refcounting. This leads to OOPS and panics triggered by the tty layer functions
> > which are invoked after the struct tty has already been destroyed.
> >
> > This happens for example when the bluetooth connection is lost because the host
> > goes down unexpectedly.
> >
> > The fix uses the tty_port_* helpers already in place.
> >
> > This patch depends on patch "Fix refcount leak in tty_port.c" already sent to
> > linux-kernel. [0]
> >
> > Signed-off-by: Gianluca Anzolin <gianluca@sottospazio.it>
> >
> > [0] http://lkml.indiana.edu/hypermail/linux/kernel/1307.1/00600.html
> >
>
> Do you have any backtraces of the OOPS and panics ?
>
> In which kernel did you discover the failure ?
>
> What platform were you using, I mean x86, ARM or something else ?
>
> Is this failure easy to reproduce ?
Just setup a RFCOMM tty and then violently break the link, by killing
the rfcomm tool, by plugging the bt adapter, by turning off one
peer, ... As soon as timeouts occur on the still running side you'll get
the panic. Almost 100% reproducible.
Ciao,
Mathias
--
Mathias Hasselmann | mathias.hasselmann@kdab.com | Software Engineer
KDAB (Deutschland) GmbH&Co KG, a KDAB Group company
Tel. Germany +49-30-521325470, Sweden (HQ) +46-563-540090
KDAB - Qt Experts - Platform-independent software solutions
next prev parent reply other threads:[~2013-07-10 8:39 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-07-09 17:05 [PATCH 1/2] Fix tty refcounting in rfcomm/tty.c Gianluca Anzolin
2013-07-10 8:17 ` Dean Jenkins
2013-07-10 8:39 ` Mathias Hasselmann [this message]
2013-07-10 11:24 ` Gianluca Anzolin
2013-07-10 9:37 ` Gianluca Anzolin
2013-07-10 10:43 ` Gianluca Anzolin
2013-07-10 15:46 ` Gustavo Padovan
2013-07-10 16:24 ` Gianluca Anzolin
2013-07-10 16:55 ` Gustavo Padovan
2013-07-10 17:01 ` Gianluca Anzolin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1373445561.4594.21.camel@smarty \
--to=mathias.hasselmann@kdab.com \
--cc=Dean_Jenkins@mentor.com \
--cc=gianluca@sottospazio.it \
--cc=gustavo@padovan.org \
--cc=linux-bluetooth@vger.kernel.org \
--cc=marcel@holtmann.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).