Octavian Purdila cf33e77b76 Bluetooth: Fix RFCOMM session reference counting issue ... There is an imbalance in the rfcomm_session_hold / rfcomm_session_put operations which causes the following crash: [ 685.010159] BUG: unable to handle kernel paging request at 6b6b6b6b [ 685.010169] IP: [<c149d76d>] rfcomm_process_dlcs+0x1b/0x15e [ 685.010181] *pdpt = 000000002d665001 *pde = 0000000000000000 [ 685.010191] Oops: 0000 [#1] PREEMPT SMP [ 685.010247] [ 685.010255] Pid: 947, comm: krfcommd Tainted: G C 3.0.16-mid8-dirty #44 [ 685.010266] EIP: 0060:[<c149d76d>] EFLAGS: 00010246 CPU: 1 [ 685.010274] EIP is at rfcomm_process_dlcs+0x1b/0x15e [ 685.010281] EAX: e79f551c EBX: 6b6b6b6b ECX: 00000007 EDX: e79f40b4 [ 685.010288] ESI: e79f4060 EDI: ed4e1f70 EBP: ed4e1f68 ESP: ed4e1f50 [ 685.010295] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 685.010303] Process krfcommd (pid: 947, ti=ed4e0000 task=ed43e5e0 task.ti=ed4e0000) [ 685.010308] Stack: [ 685.010312] ed4e1f68 c149eb53 e5925150 e79f4060 ed500000 ed4e1f70 ed4e1f80 c149ec10 [ 685.010331] 00000000 ed43e5e0 00000000 ed4e1f90 ed4e1f9c c149ec87 0000bf54 00000000 [ 685.010348] 00000000 ee03bf54 c149ec37 ed4e1fe4 c104fe01 00000000 00000000 00000000 [ 685.010367] Call Trace: [ 685.010376] [<c149eb53>] ? rfcomm_process_rx+0x6e/0x74 [ 685.010387] [<c149ec10>] rfcomm_process_sessions+0xb7/0xde [ 685.010398] [<c149ec87>] rfcomm_run+0x50/0x6d [ 685.010409] [<c149ec37>] ? rfcomm_process_sessions+0xde/0xde [ 685.010419] [<c104fe01>] kthread+0x63/0x68 [ 685.010431] [<c104fd9e>] ? __init_kthread_worker+0x42/0x42 [ 685.010442] [<c14dae82>] kernel_thread_helper+0x6/0xd This issue has been brought up earlier here: https://lkml.org/lkml/2011/5/21/127 The issue appears to be the rfcomm_session_put in rfcomm_recv_ua. This operation doesn't seem be to required as for the non-initiator case we have the rfcomm_process_rx doing an explicit put and in the initiator case the last dlc_unlink will drive the reference counter to 0. There have been several attempts to fix these issue: 6c2718d Bluetooth: Do not call rfcomm_session_put() for RFCOMM UA on closed socket 683d949 Bluetooth: Never deallocate a session when some DLC points to it but AFAICS they do not fix the issue just make it harder to reproduce. Signed-off-by: Octavian Purdila <octavian.purdila@intel.com> Signed-off-by: Gopala Krishna Murala <gopala.krishna.murala@intel.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>		2012-02-15 13:09:26 +02:00
..
9p	virtio: rename virtqueue_add_buf_gfp to virtqueue_add_buf	2012-01-12 15:44:42 +10:30
802
8021q
appletalk
atm
ax25
batman-adv
bluetooth	Bluetooth: Fix RFCOMM session reference counting issue	2012-02-15 13:09:26 +02:00
bridge	bridge: BH already disabled in br_fdb_cleanup()	2012-01-17 10:17:32 -05:00
caif	net caif: Register properly as a pernet subsystem.	2012-01-27 21:06:03 -05:00
can
ceph	libceph: remove useless return value for osd_client __send_request()	2012-01-10 08:57:03 -08:00
core	net: RTNETLINK adjusting values of min_ifinfo_dump_size	2012-01-26 16:35:57 -05:00
dcb
dccp	inet_diag: Rename inet_diag_req into inet_diag_req_v2	2012-01-11 12:56:06 -08:00
decnet	Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security	2012-01-14 18:36:33 -08:00
dns_resolver
dsa
econet
ethernet
ieee802154
ipv4	tcp: fix tcp_trim_head() to adjust segment count with skb MSS	2012-01-30 12:42:58 -05:00
ipv6	tcp: md5: using remote adress for md5 lookup in rst packet	2012-01-22 15:08:45 -05:00
ipx
irda
iucv
key
l2tp	l2tp: l2tp_ip - fix possible oops on packet receive	2012-01-25 21:45:00 -05:00
lapb
llc	llc: Fix race condition in llc_ui_recvmsg	2012-01-24 15:33:19 -05:00
mac80211	mac80211: Fix a rwlock bad magic bug	2012-02-09 15:16:04 -05:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2012-01-17 22:26:41 -08:00
netlabel	net: reintroduce missing rcu_assign_pointer() calls	2012-01-12 12:26:56 -08:00
netlink	Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security	2012-01-14 18:36:33 -08:00
netrom
nfc	NFC: Export a new attribute nfcid1 in target info	2012-01-04 14:30:43 -05:00
openvswitch	openvswitch: Fix multipart datapath dumps.	2012-01-17 23:56:19 -05:00
packet
phonet	net: reintroduce missing rcu_assign_pointer() calls	2012-01-12 12:26:56 -08:00
rds	rds: Make rds_sock_lock BH rather than IRQ safe.	2012-01-24 17:03:44 -05:00
rfkill	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2012-01-05 10:13:24 -05:00
rose
rxrpc
sched	netem: Fix off-by-one bug in reordering	2012-01-22 15:08:44 -05:00
sctp	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2012-01-08 13:21:22 -08:00
sunrpc	Merge branch 'for-3.3' of git://linux-nfs.org/~bfields/linux	2012-01-14 12:26:41 -08:00
tipc
unix	af_unix: fix EPOLLET regression for stream sockets	2012-01-30 12:45:07 -05:00
wanrouter
wimax
wireless	nl80211: fix old station flags compatibility	2012-01-11 15:14:50 -05:00
x25
xfrm	Merge branch 'for-linus' of git://selinuxproject.org/~jmorris/linux-security	2012-01-14 18:36:33 -08:00
compat.c
Kconfig
Makefile
nonet.c
socket.c	net: reintroduce missing rcu_assign_pointer() calls	2012-01-12 12:26:56 -08:00
sysctl_net.c