Hi, We recently faced some problems when using an BT uart chip interfaced through the H5 proto (rtk_h5). Here are the logs of the 2 different issues we had when closing the line discipline (actually, restoring the previous one) [1][2]. I know the kernel is Tainted in those logs, but after some investigations I found a few potential issues that might explain what we're seeing. Patches 1 and 2 are fixing 2 potential 'use after free' bugs: in some (unlikely) cases the timer and work we try to cancel in the closing path can be re-scheduled in our back, and since we're releasing the memory region assigned to those elements at the end of the closing procedure we can end-up with those invalid pointer exception when the work or timer handler is called. Note that this problem is pretty hard to reproduce, so I'm not sure my patches are fixing all the racy paths. Patches 3 and 4 are fixing potential issues that I didn't directly face but may be worth fixing. Path 3 is fixing a potential double free issue (proto->close() called twice if the hdev registration failed). Patch 4 is making sure we don't loose some TX events. Let me know what you think. Thanks, Boris [1]http://code.bulix.org/8qtjly-105082 [2]http://code.bulix.org/qzur9n-105083 Boris Brezillon (4): Bluetooth: hci_ldisc: fix a race in the hdev closing path Bluetooth: hci_h5: fix a race in the closing path Bluetooth: hci_ldisc: don't release resources in hci_uart_init_work() Bluetooth: hci_ldisc: make sure we don't loose HCI_UART_TX_WAKEUP events drivers/bluetooth/hci_h5.c | 7 ++++++- drivers/bluetooth/hci_ldisc.c | 30 ++++++++++++++++++++++++++---- drivers/bluetooth/hci_uart.h | 1 + 3 files changed, 33 insertions(+), 5 deletions(-) -- 2.7.4 -- To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
