forked from Minki/linux
fcee337704
If hci_dev_open() is called after hci_register_dev() added the device to the hci_dev_list but before the workqueue are created we could run into a NULL pointer dereference (see below). This bug is very unlikely to happen, systems using bluetoothd to manage their bluetooth devices will never see this happen. BUG: unable to handle kernel NULL pointer dereference 0100 IP: [<ffffffff81077502>] __queue_work+0x32/0x3d0 (...) Call Trace: [<ffffffff81077be5>] queue_work_on+0x45/0x50 [<ffffffffa016e8ff>] hci_req_run+0xbf/0xf0 [bluetooth] [<ffffffffa01709b0>] ? hci_init2_req+0x720/0x720 [bluetooth] [<ffffffffa016ea06>] __hci_req_sync+0xd6/0x1c0 [bluetooth] [<ffffffff8108ee10>] ? try_to_wake_up+0x2b0/0x2b0 [<ffffffff8150e3f0>] ? usb_autopm_put_interface+0x30/0x40 [<ffffffffa016fad5>] hci_dev_open+0x275/0x2e0 [bluetooth] [<ffffffffa0182752>] hci_sock_ioctl+0x1f2/0x3f0 [bluetooth] [<ffffffff815c6050>] sock_do_ioctl+0x30/0x70 [<ffffffff815c75f9>] sock_ioctl+0x79/0x2f0 [<ffffffff811a8046>] do_vfs_ioctl+0x96/0x560 [<ffffffff811a85a1>] SyS_ioctl+0x91/0xb0 [<ffffffff816d989d>] system_call_fastpath+0x1a/0x1f Reported-by: Sedat Dilek <sedat.dilek@gmail.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk> |
||
|---|---|---|
| .. | ||
| bnep | ||
| cmtp | ||
| hidp | ||
| rfcomm | ||
| a2mp.c | ||
| af_bluetooth.c | ||
| amp.c | ||
| hci_conn.c | ||
| hci_core.c | ||
| hci_event.c | ||
| hci_sock.c | ||
| hci_sysfs.c | ||
| Kconfig | ||
| l2cap_core.c | ||
| l2cap_sock.c | ||
| lib.c | ||
| Makefile | ||
| mgmt.c | ||
| sco.c | ||
| smp.c | ||