From: Andrei Emeltchenko Date: Mon, 24 Jan 2011 08:53:24 +0000 (+0200) Subject: Bluetooth: fix crash by disabling tasklet in sock accept X-Git-Tag: v2.6.39-rc1~468^2~238^2^2~95 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d37f50e19094862a5d60d79637d6f4dbdc42f4f1;p=pandora-kernel.git Bluetooth: fix crash by disabling tasklet in sock accept Crash can happen when tasklet handling connect/disconnect requests preempts socket accept. Can be reproduced with "l2test -r" on one side and several "l2test -c -b 1000 -i hci0 -P 10 " on the other side. disable taskets in socket accept and change lock_sock and release_sock to bh_lock_sock and bh_unlock_sock since we have to use spinlocks and there is no need to mark sock as owned by user. ... [ 3555.897247] Unable to handle kernel NULL pointer dereference at virtual address 000000bc [ 3555.915039] pgd = cab9c000 [ 3555.917785] [000000bc] *pgd=8bf3d031, *pte=00000000, *ppte=00000000 [ 3555.928314] Internal error: Oops: 17 [#1] PREEMPT [ 3555.999786] CPU: 0 Not tainted (2.6.32.21-13874-g67918ef #65) ... [ 3556.005981] PC is at bt_accept_unlink+0x20/0x58 [bluetooth] [ 3556.011627] LR is at bt_accept_dequeue+0x3c/0xe8 [bluetooth] ... [ 3556.161285] [] (bt_accept_unlink+0x20/0x58 [bluetooth]) from [] (bt_accept_dequeue+0x3c/0xe8 [bluetooth]) [ 3556.172729] [] (bt_accept_dequeue+0x3c/0xe8 [bluetooth]) from [] (l2cap_sock_accept+0x100/0x15c [l2cap]) [ 3556.184082] [] (l2cap_sock_accept+0x100/0x15c [l2cap]) from [] (sys_accept4+0x120/0x1e0) [ 3556.193969] [] (sys_accept4+0x120/0x1e0) from [] (ret_fast_syscall+0x0/0x2c) [ 3556.202819] Code: e5813000 e5901164 e580c160 e580c15c (e1d13bbc) ... Signed-off-by: Andrei Emeltchenko Signed-off-by: Gustavo F. Padovan --- Reading git-diff-tree failed