1. 02 11月, 2012 1 次提交
  2. 24 10月, 2012 1 次提交
  3. 11 10月, 2012 2 次提交
  4. 28 9月, 2012 1 次提交
  5. 09 9月, 2012 1 次提交
  6. 27 8月, 2012 1 次提交
  7. 22 8月, 2012 1 次提交
  8. 15 8月, 2012 7 次提交
  9. 30 6月, 2012 2 次提交
  10. 05 6月, 2012 9 次提交
  11. 09 5月, 2012 5 次提交
  12. 29 3月, 2012 1 次提交
  13. 23 2月, 2012 1 次提交
  14. 20 2月, 2012 1 次提交
  15. 19 2月, 2012 1 次提交
  16. 17 2月, 2012 2 次提交
  17. 15 2月, 2012 1 次提交
  18. 13 2月, 2012 2 次提交
    • A
      Bluetooth: Use list _safe deleting from conn chan_list · 2a5a5ec6
      Andrei Emeltchenko 提交于
      Fixes possible bug when deleting element from the list in
      function hci_chan_list_flush. list_for_each_entry_rcu is used
      and after deleting element from the list we also free pointer
      and then list_entry_rcu is taken from freed pointer.
      Signed-off-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Acked-by: NMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
      2a5a5ec6
    • A
      Bluetooth: Use list _safe deleting from conn_hash_list · 3c4e0df0
      Andrei Emeltchenko 提交于
      Use list_for_each_entry_safe which is safe version against removal
      of list entry. Otherwise we remove hci_conn element and reference
      next element which result in accessing LIST_POISON.
      
      [   95.571834] Bluetooth: unknown link type 127
      [   95.578349] BUG: unable to handle kernel paging request at 20002000
      [   95.580236] IP: [<20002000>] 0x20001fff
      [   95.580763] *pde = 00000000
      [   95.581196] Oops: 0000 [#1] SMP
      ...
      [   95.582298] Pid: 3355, comm: hciconfig Tainted: G   O 3.2.0-VirttualBox
      [   95.582298] EIP: 0060:[<20002000>] EFLAGS: 00210206 CPU: 0
      [   95.582298] EIP is at 0x20002000
      ...
      [   95.582298] Call Trace:
      [   95.582298]  [<f8231ab6>] ? hci_conn_hash_flush+0x76/0xf0 [bluetooth]
      [   95.582298]  [<f822bcb1>] hci_dev_do_close+0xc1/0x2e0 [bluetooth]
      [   95.582298]  [<f822d679>] ? hci_dev_get+0x69/0xb0 [bluetooth]
      [   95.582298]  [<f822e1da>] hci_dev_close+0x2a/0x50 [bluetooth]
      [   95.582298]  [<f824102f>] hci_sock_ioctl+0x1af/0x3f0 [bluetooth]
      [   95.582298]  [<c11153ea>] ? handle_pte_fault+0x8a/0x8f0
      [   95.582298]  [<c146becf>] sock_ioctl+0x5f/0x260
      [   95.582298]  [<c146be70>] ? sock_fasync+0x90/0x90
      [   95.582298]  [<c1152b33>] do_vfs_ioctl+0x83/0x5b0
      [   95.582298]  [<c1563f87>] ? do_page_fault+0x297/0x500
      [   95.582298]  [<c1563cf0>] ? spurious_fault+0xd0/0xd0
      [   95.582298]  [<c107165b>] ? up_read+0x1b/0x30
      [   95.582298]  [<c1563f87>] ? do_page_fault+0x297/0x500
      [   95.582298]  [<c100aa9f>] ? init_fpu+0xef/0x160
      [   95.582298]  [<c15617c0>] ? do_debug+0x180/0x180
      [   95.582298]  [<c100a958>] ? fpu_finit+0x28/0x80
      [   95.582298]  [<c11530e7>] sys_ioctl+0x87/0x90
      [   95.582298]  [<c156795f>] sysenter_do_call+0x12/0x38
      ...
      Signed-off-by: NAndrei Emeltchenko <andrei.emeltchenko@intel.com>
      Acked-by: NMarcel Holtmann <marcel@holtmann.org>
      Signed-off-by: NJohan Hedberg <johan.hedberg@intel.com>
      3c4e0df0