• Ilia Kolomisnky's avatar
    Bluetooth: Fix crash with incoming L2CAP connections · 05e9a2f6
    Ilia Kolomisnky authored
    Another regression fix considering incomming l2cap connections with
    defer_setup enabled. In situations when incomming connection is
    extracted with l2cap_sock_accept, it's bt_sock info will have
    'parent' member zerroed, but 'parent' may be used unconditionally
    in l2cap_conn_start() and l2cap_security_cfm() when defer_setup
    is enabled.
    
    Backtrace:
    [<bf02d5ac>] (l2cap_security_cfm+0x0/0x2ac [bluetooth]) from [<bf01f01c>] (hci_event_pac
    ket+0xc2c/0x4aa4 [bluetooth])
    [<bf01e3f0>] (hci_event_packet+0x0/0x4aa4 [bluetooth]) from [<bf01a844>] (hci_rx_task+0x
    cc/0x27c [bluetooth])
    [<bf01a778>] (hci_rx_task+0x0/0x27c [bluetooth]) from [<c008eee4>] (tasklet_action+0xa0/
    0x15c)
    [<c008ee44>] (tasklet_action+0x0/0x15c) from [<c008f38c>] (__do_softirq+0x98/0x130)
     r7:00000101 r6:00000018 r5:00000001 r4:efc46000
    [<c008f2f4>] (__do_softirq+0x0/0x130) from [<c008f524>] (do_softirq+0x4c/0x58)
    [<c008f4d8>] (do_softirq+0x0/0x58) from [<c008f5e0>] (run_ksoftirqd+0xb0/0x1b4)
     r4:efc46000 r3:00000001
    [<c008f530>] (run_ksoftirqd+0x0/0x1b4) from [<c009f2a8>] (kthread+0x84/0x8c)
     r7:00000000 r6:c008f530 r5:efc47fc4 r4:efc41f08
    [<c009f224>] (kthread+0x0/0x8c) from [<c008cc84>] (do_exit+0x0/0x5f0)
    Signed-off-by: default avatarIlia Kolomisnky <iliak@ti.com>
    Signed-off-by: default avatarGustavo F. Padovan <padovan@profusion.mobi>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    05e9a2f6
l2cap_core.c 94.4 KB