Hi Johan, * Johan Hedberg <johan.hedberg@xxxxxxxxx> [2012-06-06 18:44:11 +0800]: > From: Johan Hedberg <johan.hedberg@xxxxxxxxx> > > The l2cap_conn_del function tries to cancel_sync the security timer, but > when it's called from the timeout function itself a deadlock occurs. > Subsequently the "hcon->l2cap_data = NULL" that's supposed to protect > multiple calls to l2cap_conn_del never gets cleared and when the > connection finally drops we double free's etc which will crash the > kernel. > > This patch fixes the issue by using the HCI_CONN_LE_SMP_PEND for > protecting against this. The same flag is also used for the same purpose > in other places in the SMP code. > > Signed-off-by: Johan Hedberg <johan.hedberg@xxxxxxxxx> > --- > net/bluetooth/l2cap_core.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) It looks ok to me, patch has been applied to bluetooth.git. Thanks. Gustavo -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
