From: Michael Knudsen <m.knudsen@samsung.com>
Date: Tue, 18 Feb 2014 08:48:08 +0000 (+0100)
Subject: Bluetooth: Stop BCSP/H5 timer before cleaning up
X-Git-Tag: v3.15-rc1~113^2~93^2^2~4^2~22
X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c327cddd184059d018b12d7ef818ba0961200079;p=pandora-kernel.git

Bluetooth: Stop BCSP/H5 timer before cleaning up

When stopping BCSP/H5, stop the retransmission timer before proceeding
to clean up packet queues.  The previous code had a race condition where
the timer could trigger after the packet lists and protocol structure
had been removed which led to dereferencing NULL or use-after-free bugs.

Signed-off-by: Michael Knudsen <m.knudsen@samsung.com>
Reported-by: Kirill Tkhai <ktkhai@parallels.com>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---

Reading git-diff-tree failed