If the waker is killed before it can replay outstanding URBs,
these URBs won't be freed or will be replayed at the next open.
This patch closes the window by explicitely discarding outstanding
URBs.
Signed-off-by: Oliver Neukum <oliver@xxxxxxxxxx>
Rafael, could you test this just to make sure? I don't want to screw
up the same driver twice.
Regards
Oliver
--
commit 8a3e793888c75bc7a49ff8b0be7ec6bd5438d985
Author: Oliver Neukum <oliver@xxxxxxxxxx>
Date: Thu Nov 12 16:41:46 2009 +0100
btusb: close race in disconnect leading to a memory leak
if the waker work is cancelled any deferred IO must be discarded
in close to free the memory and make sure the data isn't replayed
later
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 2fb3802..44bc8bb 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -600,11 +600,13 @@ static int btusb_close(struct hci_dev *hdev)
btusb_stop_traffic(data);
err = usb_autopm_get_interface(data->intf);
if (err < 0)
- return 0;
+ goto failed;
data->intf->needs_remote_wakeup = 0;
usb_autopm_put_interface(data->intf);
+failed:
+ usb_scuttle_anchored_urbs(&data->deferred);
return 0;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
