public inbox for linux-bluetooth@vger.kernel.org
 help / color / mirror / Atom feed
From: Oliver Neukum <oliver@neukum.org>
To: "Rafael J. Wysocki" <rjw@sisk.pl>,
	Marcel Holtmann <marcel@holtmann.org>,
	linux-bluetooth@vger.kernel.org
Subject: fix memory leak in fixed btusb_close
Date: Thu, 12 Nov 2009 16:52:31 +0100	[thread overview]
Message-ID: <200911121652.31850.oliver@neukum.org> (raw)

If the waker is killed before it can replay outstanding URBs,
these URBs won't be freed or will be replayed at the next open.
This patch closes the window by explicitely discarding outstanding
URBs.

Signed-off-by: Oliver Neukum <oliver@neukum.org>

Rafael, could you test this just to make sure? I don't want to screw
up the same driver twice.

	Regards
		Oliver

--

commit 8a3e793888c75bc7a49ff8b0be7ec6bd5438d985
Author: Oliver Neukum <oliver@neukum.org>
Date:   Thu Nov 12 16:41:46 2009 +0100

    btusb: close race in disconnect leading to a memory leak
    
    if the waker work is cancelled any deferred IO must be discarded
    in close to free the memory and make sure the data isn't replayed
    later

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2fb3802..44bc8bb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -600,11 +600,13 @@ static int btusb_close(struct hci_dev *hdev)
 	btusb_stop_traffic(data);
 	err = usb_autopm_get_interface(data->intf);
 	if (err < 0)
-		return 0;
+		goto failed;
 
 	data->intf->needs_remote_wakeup = 0;
 	usb_autopm_put_interface(data->intf);
 
+failed:
+	usb_scuttle_anchored_urbs(&data->deferred);
 	return 0;
 }
 

             reply	other threads:[~2009-11-12 15:52 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-11-12 15:52 Oliver Neukum [this message]
2009-11-12 22:13 ` fix memory leak in fixed btusb_close Rafael J. Wysocki
2009-11-13  3:08 ` Marcel Holtmann
2009-11-13  9:53   ` Oliver Neukum
2009-11-13 11:14     ` Marcel Holtmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200911121652.31850.oliver@neukum.org \
    --to=oliver@neukum.org \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=marcel@holtmann.org \
    --cc=rjw@sisk.pl \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox