Johan Hovold c1a658c944 Bluetooth: hci_core: fix NULL-pointer dereference at unregister ... commit 9432496206 upstream. Make sure hci_dev_open returns immediately if hci_dev_unregister has been called. This fixes a race between hci_dev_open and hci_dev_unregister which can lead to a NULL-pointer dereference. Bug is 100% reproducible using hciattach and a disconnected serial port: 0. # hciattach -n /dev/ttyO1 any noflow 1. hci_dev_open called from hci_power_on grabs req lock 2. hci_init_req executes but device fails to initialise (times out eventually) 3. hci_dev_open is called from hci_sock_ioctl and sleeps on req lock 4. hci_uart_tty_close calls hci_dev_unregister and sleeps on req lock in hci_dev_do_close 5. hci_dev_open (1) releases req lock 6. hci_dev_do_close grabs req lock and returns as device is not up 7. hci_dev_unregister sleeps in destroy_workqueue 8. hci_dev_open (3) grabs req lock, calls hci_init_req and eventually sleeps 9. hci_dev_unregister finishes, while hci_dev_open is still running... [ 79.627136] INFO: trying to register non-static key. [ 79.632354] the code is fine but needs lockdep annotation. [ 79.638122] turning off the locking correctness validator. [ 79.643920] [<c00188bc>] (unwind_backtrace+0x0/0xf8) from [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) [ 79.653594] [<c00729c4>] (__lock_acquire+0x1590/0x1ab0) from [<c00733f8>] (lock_acquire+0x9c/0x128) [ 79.663085] [<c00733f8>] (lock_acquire+0x9c/0x128) from [<c0040a88>] (run_timer_softirq+0x150/0x3ac) [ 79.672668] [<c0040a88>] (run_timer_softirq+0x150/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c) [ 79.682281] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94) [ 79.690856] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84) [ 79.699157] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) [ 79.708648] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60) [ 79.718048] Exception stack(0xcf281fb0 to 0xcf281ff8) [ 79.723358] 1fa0: 0001e6a0 be8dab00 0001e698 00036698 [ 79.731933] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000 [ 79.740509] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff [ 79.747497] Unable to handle kernel NULL pointer dereference at virtual address 00000000 [ 79.756011] pgd = cf3b4000 [ 79.758850] [00000000] *pgd=8f0c7831, *pte=00000000, *ppte=00000000 [ 79.765502] Internal error: Oops: 80000007 [#1] [ 79.770294] Modules linked in: [ 79.773529] CPU: 0 Tainted: G W (3.3.0-rc6-00002-gb5d5c87 #421) [ 79.781066] PC is at 0x0 [ 79.783721] LR is at run_timer_softirq+0x16c/0x3ac [ 79.788787] pc : [<00000000>] lr : [<c0040aa4>] psr: 60000113 [ 79.788787] sp : cf281ee0 ip : 00000000 fp : cf280000 [ 79.800903] r10: 00000004 r9 : 00000100 r8 : b6f234d0 [ 79.806427] r7 : c0519c28 r6 : cf093488 r5 : c0561a00 r4 : 00000000 [ 79.813323] r3 : 00000000 r2 : c054eee0 r1 : 00000001 r0 : 00000000 [ 79.820190] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 79.827728] Control: 10c5387d Table: 8f3b4019 DAC: 00000015 [ 79.833801] Process gpsd (pid: 1265, stack limit = 0xcf2802e8) [ 79.839965] Stack: (0xcf281ee0 to 0xcf282000) [ 79.844573] 1ee0: 00000002 00000000 c0040a24 00000000 00000002 cf281f08 00200200 00000000 [ 79.853210] 1f00: 00000000 cf281f18 cf281f08 00000000 00000000 00000000 cf281f18 cf281f18 [ 79.861816] 1f20: 00000000 00000001 c056184c 00000000 00000001 b6f234d0 c0561848 00000004 [ 79.870452] 1f40: cf280000 c003a3b8 c051e79c 00000001 00000000 00000100 3fa9e7b8 0000000a [ 79.879089] 1f60: 00000025 cf280000 00000025 00000000 00000000 b6f234d0 00000000 00000004 [ 79.887756] 1f80: 00000000 c003a924 c053ad38 c0013a50 fa200000 cf281fb0 ffffffff c0008530 [ 79.896362] 1fa0: 0001e6a0 0000aab8 80000010 c037499c 0001e6a0 be8dab00 0001e698 00036698 [ 79.904998] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000 [ 79.913665] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff 00fbf700 04ffff00 [ 79.922302] [<c0040aa4>] (run_timer_softirq+0x16c/0x3ac) from [<c003a3b8>] (__do_softirq+0xd4/0x22c) [ 79.931945] [<c003a3b8>] (__do_softirq+0xd4/0x22c) from [<c003a924>] (irq_exit+0x8c/0x94) [ 79.940582] [<c003a924>] (irq_exit+0x8c/0x94) from [<c0013a50>] (handle_IRQ+0x34/0x84) [ 79.948913] [<c0013a50>] (handle_IRQ+0x34/0x84) from [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) [ 79.958404] [<c0008530>] (omap3_intc_handle_irq+0x48/0x4c) from [<c037499c>] (__irq_usr+0x3c/0x60) [ 79.967773] Exception stack(0xcf281fb0 to 0xcf281ff8) [ 79.973083] 1fa0: 0001e6a0 be8dab00 0001e698 00036698 [ 79.981658] 1fc0: 0002df98 0002df38 0000001f 00000000 b6f234d0 00000000 00000004 00000000 [ 79.990234] 1fe0: 0001e6f8 be8d6aa0 be8dac50 0000aab8 80000010 ffffffff [ 79.997161] Code: bad PC value [ 80.000396] ---[ end trace 6f6739840475f9ee ]--- [ 80.005279] Kernel panic - not syncing: Fatal exception in interrupt Signed-off-by: Johan Hovold <jhovold@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2012-04-22 16:21:42 -07:00
..
9p	net/9p: Fix kernel crash with msize 512K	2011-10-03 11:40:22 -07:00
802	snap: remove one synchronize_net()	2011-05-23 16:29:24 -04:00
8021q	vlan: reset headers on accel emulation path	2011-10-03 11:40:55 -07:00
appletalk	appletalk: Fix OOPS in atalk_release().	2011-03-31 18:59:10 -07:00
atm	net: fix NULL dereferences in check_peer_redir()	2012-02-13 11:06:13 -08:00
ax25	ax25: Fix set-but-unused variable.	2011-04-17 00:48:31 -07:00
batman-adv	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6	2011-05-20 13:43:21 -07:00
bluetooth	Bluetooth: hci_core: fix NULL-pointer dereference at unregister	2012-04-22 16:21:42 -07:00
bridge	bridge: check return value of ipv6_dev_get_saddr()	2012-03-19 08:57:46 -07:00
caif	net caif: Register properly as a pernet subsystem.	2012-02-03 09:19:03 -08:00
can	can bcm: fix incomplete tx_setup fix	2011-11-11 09:36:45 -08:00
ceph	ceph: fix file mode calculation	2011-07-19 11:25:04 -07:00
core	net: fix napi_reuse_skb() skb reserve	2012-04-02 09:27:21 -07:00
dcb	net: dcbnl: Update copyright dates	2011-03-14 17:02:42 -07:00
dccp	net: Compute protocol sequence numbers and fragment IDs using MD5.	2011-08-15 18:31:35 -07:00
decnet	net: fix NULL dereferences in check_peer_redir()	2012-02-13 11:06:13 -08:00
dns_resolver	KEYS: Improve /proc/keys	2011-03-17 11:59:32 +11:00
dsa	Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6	2011-05-05 14:59:02 -07:00
econet	econet: Fix set-but-unused variable.	2011-04-17 00:15:22 -07:00
ethernet	net: add IFF_SKB_TX_SHARED flag to priv_flags	2011-08-15 18:31:38 -07:00
ieee802154	ieee802154: Don't leak memory in ieee802154_nl_fill_phy	2011-06-13 18:03:22 -04:00
ipv4	tcp: fix syncookie regression	2012-03-23 11:20:51 -07:00
ipv6	net: fix a potential rcu_read_lock() imbalance in rt6_fill_node()	2012-04-02 09:27:20 -07:00
ipx	ipx: fix ipx_release()	2011-03-21 18:16:39 -07:00
irda	irda: iriap: Use seperate lockdep class for irias_objects->hb_spinlock	2011-06-06 17:00:35 -07:00
iucv	[S390] irq: merge irq.c and s390_ext.c	2011-05-26 09:48:24 +02:00
key	net: convert %p usage to %pK	2011-05-24 01:13:12 -04:00
l2tp	Fix pppol2tp getsockname()	2012-04-02 09:27:20 -07:00
lapb
llc	llc: llc_cmsg_rcv was getting called after sk_eat_skb.	2012-01-06 14:14:06 -08:00
mac80211	mac80211: fix possible tid_rx->reorder_timer use after free	2012-04-13 08:14:06 -07:00
netfilter	ipvs: fix matching of fwmark templates during scheduling	2012-02-29 16:34:31 -08:00
netlabel	Remove prefetch() from <linux/skbuff.h> and "netlabel_addrlist.h"	2011-05-22 21:43:41 -07:00
netlink	net: convert %p usage to %pK	2011-05-24 01:13:12 -04:00
netrom	NET: AX.25, NETROM, ROSE: Remove SOCK_DEBUG calls	2011-04-14 00:20:07 -07:00
packet	make PACKET_STATISTICS getsockopt report consistently between ring and non-ring	2011-11-11 09:36:29 -08:00
phonet	net: convert %p usage to %pK	2011-05-24 01:13:12 -04:00
rds	Remove printk from rds_sendmsg	2012-04-02 09:27:21 -07:00
rfkill	net: rfkill: add generic gpio rfkill driver	2011-05-19 13:53:54 -04:00
rose	rose_dev: fix memcpy-bug in rose_set_mac_address	2012-04-13 08:14:05 -07:00
rxrpc	rxrpc: Fix set but unused variable 'usage' in rxrpc_get_transport()	2011-05-19 18:51:50 -04:00
sched	net_sched: Bug in netem reordering	2012-02-29 16:34:07 -08:00
sctp	sctp: Do not account for sizeof(struct sk_buff) in estimated rwnd	2012-01-06 14:14:09 -08:00
sunrpc	nfsd: don't allow zero length strings in cache_parse()	2012-04-02 09:27:21 -07:00
tipc	tipc: Revise timings used when sending link request messages	2011-05-10 16:04:02 -04:00
unix	net: convert %p usage to %pK	2011-05-24 01:13:12 -04:00
wanrouter	Fix common misspellings	2011-03-31 11:26:23 -03:00
wimax
wireless	cfg80211: amend regulatory NULL dereference fix	2011-12-09 08:52:45 -08:00
x25	x25: Prevent skb overreads when checking call user data	2011-10-25 07:10:17 +02:00
xfrm	xfrm: Access the replay notify functions via the registered callbacks	2012-04-02 09:27:21 -07:00
compat.c	net: Add sendmmsg socket system call	2011-05-05 11:10:14 -07:00
Kconfig	bpf: depends on MODULES	2011-04-29 10:20:53 -07:00
Makefile	net: Enter net/ipv6/ even if CONFIG_IPV6=n	2011-03-07 12:50:52 -08:00
nonet.c
socket.c	sendmmsg/sendmsg: fix unsafe user pointer access	2011-10-03 11:39:54 -07:00
sysctl_net.c
TUNABLE