Function del_timer() does not guarantee that timer was really deleted. If the timer handler is beeing executed at the moment, the function just returns. So, it's possible to use already freed memory in the handler: [ref: Documentation/DocBook/kernel-locking.tmpl] This was found using grep and compile-tested only. Signed-off-by: Kirill Tkhai <ktkhai@xxxxxxxxxxxxx> CC: Marcel Holtmann <marcel@xxxxxxxxxxxx> CC: Gustavo Padovan <gustavo@xxxxxxxxxxx> CC: Johan Hedberg <johan.hedberg@xxxxxxxxx> --- drivers/bluetooth/hci_bcsp.c | 2 +- drivers/bluetooth/hci_h5.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c index 0bc87f7..d796a6d 100644 --- a/drivers/bluetooth/hci_bcsp.c +++ b/drivers/bluetooth/hci_bcsp.c @@ -722,7 +722,7 @@ static int bcsp_close(struct hci_uart *hu) skb_queue_purge(&bcsp->unack); skb_queue_purge(&bcsp->rel); skb_queue_purge(&bcsp->unrel); - del_timer(&bcsp->tbcsp); + del_timer_sync(&bcsp->tbcsp); kfree(bcsp); return 0; diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c index f6f4974..9f007f6 100644 --- a/drivers/bluetooth/hci_h5.c +++ b/drivers/bluetooth/hci_h5.c @@ -210,7 +210,7 @@ static int h5_close(struct hci_uart *hu) skb_queue_purge(&h5->rel); skb_queue_purge(&h5->unrel); - del_timer(&h5->timer); + del_timer_sync(&h5->timer); kfree(h5); -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
