linux/drivers
David Newall 3611f4d2a5 hci_ldisc: fix null pointer deref
Arjan:

  With the help of kerneloops.org I've spotted a nice little interaction
  between the TTY layer and the bluetooth code, however the tty layer is not
  something I'm all too familiar with so I rather ask than brute-force fix the
  code incorrectly.

  The raw details are at:
  http://www.kerneloops.org/search.php?search=uart_flush_buffer

  What happens is that, on closing the bluetooth tty, the tty layer goes
  into the release_dev() function, which first does a bunch of stuff, then
  sets the file->private_data to NULL, does some more stuff and then calls the
  ldisc close function.  Which in this case, is hci_uart_tty_close().

  Now, hci_uart_tty_close() calls hci_uart_close() which clears some
  internal bit, and then calls hci_uart_flush()...  which calls back to the
  tty layers' uart_flush_buffer() function.  (in drivers/bluetooth/hci_tty.c
  around line 194) Which then WARN_ON()'s because that's not allowed/supposed
  to be called this late in the shutdown of the port....

  Should the bluetooth driver even call this flush function at all??

David:

  This seems to be what happens: Hci_uart_close() flushes using
  hci_uart_flush().  Subsequently, in hci_dev_do_close(), (one step in
  hci_unregister_dev()), hci_uart_flush() is called again.  The comment in
  uart_flush_buffer(), relating to the WARN_ON(), indicates you can't flush
  after the port is closed; which sounds reasonable.  I think hci_uart_close()
  should set hdev->flush to NULL before returning.  Hci_dev_do_close() does
  check for this.  The code path is rather involved and I'm not entirely clear
  of all steps, but I think that's what should be done.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-02-12 17:54:16 -08:00
..
acorn/char
acpi WMI: initialize wmi_blocks.list even if ACPI is disabled 2008-02-11 20:52:01 -08:00
amba
ata sata_mv: platform driver allocs dma without create 2008-02-11 14:30:10 -05:00
atm
auxdisplay
base Driver core: Revert "Fix Firmware class name collision" 2008-02-07 11:31:46 -08:00
block ub: fix up the conversion to sg_init_table() 2008-02-09 11:08:33 -08:00
bluetooth hci_ldisc: fix null pointer deref 2008-02-12 17:54:16 -08:00
cdrom Merge branch 'for-2.6.25' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc 2008-02-07 09:02:26 -08:00
char sonypi - Move sonypi.txt to Documentation/laptops 2008-02-09 04:15:53 -05:00
clocksource
connector
cpufreq [CPUFREQ] fix configuration help message 2008-02-06 22:57:58 -05:00
cpuidle cpuidle: build fix for non-x86 2008-02-09 03:33:40 -05:00
crypto
dca DCA: convert struct class_device to struct device. 2008-02-08 15:33:33 -08:00
dio dio: ARRAY_SIZE() cleanup 2008-02-05 09:44:23 -08:00
dma async_tx: replace 'int_en' with operation preparation flags 2008-02-06 10:12:18 -07:00
edac drivers/edac/i3000: document type promotion 2008-02-07 08:42:23 -08:00
eisa
firewire
firmware SMBIOS/DMI: add type 41 = Onboard Devices Extended Information 2008-02-08 09:22:37 -08:00
gpio gpio: handle pca953{4,5,6,7,8} too 2008-02-06 10:41:15 -08:00
hid
hwmon hwmon: (lm80) Add individual alarm files 2008-02-07 20:39:45 -05:00
i2c hwmon: Discard useless I2C driver IDs 2008-02-07 20:39:44 -05:00
ide ide: remove stale comment from ide-lib.c 2008-02-11 00:32:15 +01:00
ieee1394 ieee1394: sbp2: fix bogus s/g access change 2008-02-02 13:48:16 +01:00
infiniband IPoIB: Add send gather support 2008-02-08 14:32:37 -08:00
input mn10300: add the MN10300/AM33 architecture to the kernel 2008-02-08 09:22:30 -08:00
isdn isdn: fix section mismatch warning for ISACVer 2008-02-09 23:29:28 -08:00
leds PWM LED driver 2008-02-08 09:22:38 -08:00
lguest lguest: accept guest _PAGE_PWT page table entries 2008-02-09 23:24:09 +01:00
macintosh [POWERPC] Disable G5 NAP mode during SMU commands on U3 2008-02-08 19:52:35 +11:00
mca
md dm raid1: report fault status 2008-02-08 02:11:39 +00:00
media drivers/media/video/em28xx/: Fix undefined symbol error with CONFIG_SND=N 2008-02-09 23:27:01 -08:00
memstick memstick: initial commit for Sony MemoryStick support 2008-02-09 11:08:34 -08:00
message drivers/message/: Spelling fixes 2008-02-03 17:21:01 +02:00
mfd ASIC3 driver 2008-02-07 08:42:23 -08:00
misc Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2008-02-09 11:12:31 -08:00
mmc mmc: extend ricoh_mmc to support Ricoh RL5c476 2008-02-08 09:02:47 +01:00
mtd [MTD] [NAND] cs553x_nand: command line partitioning support 2008-02-09 08:21:31 +00:00
net Merge branch 'upstream-davem' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6 2008-02-12 17:51:26 -08:00
nubus nubus: kill drivers/nubus/nubus_syms.c 2008-02-05 09:44:23 -08:00
of [POWERPC] Create and hook up of_platform_device_shutdown 2008-02-06 16:29:59 +11:00
oprofile
parisc iommu sg merging: parisc: make iommu respect the segment size limits 2008-02-05 09:44:10 -08:00
parport parport: fix ieee1284_epp_read_addr 2008-02-08 09:22:36 -08:00
pci mn10300: add the MN10300/AM33 architecture to the kernel 2008-02-08 09:22:30 -08:00
pcmcia ide: introduce HAVE_IDE 2008-02-09 10:46:40 +01:00
pnp Merge branches 'release', 'bugzilla-6217', 'bugzilla-6629', 'bugzilla-6933', 'bugzilla-7186', 'bugzilla-8269', 'bugzilla-8570', 'bugzilla-9139', 'bugzilla-9277', 'bugzilla-9341', 'bugzilla-9444', 'bugzilla-9614', 'bugzilla-9643' and 'bugzilla-9644' into release 2008-02-07 03:09:43 -05:00
power Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6 2008-02-07 09:45:58 -08:00
ps3 ps3: use symbolic names for video modes 2008-02-06 10:41:17 -08:00
rapidio
rtc rtc-r9701.c: silence compiler warning 2008-02-09 23:27:01 -08:00
s390 claw/lcs/netiucv: check s390dbf level before sprints 2008-02-11 11:14:50 -05:00
sbus
scsi scsi: fix makefile for aic7(3*x) 2008-02-09 10:43:58 +01:00
serial fs/char_dev.c: chrdev_open marked static and removed from fs.h 2008-02-08 09:22:42 -08:00
sh
sn
spi spi: remove more dev->power.power_state usage 2008-02-06 10:41:11 -08:00
ssb drivers/ssb/: Spelling fixes 2008-02-03 17:30:25 +02:00
tc
telephony
thermal ACPI: thermal: syntax, spelling, kernel-doc 2008-02-07 23:48:04 -05:00
uio uio: nopage 2008-02-06 10:41:07 -08:00
usb usb: net2280 can't have a function called show_registers() 2008-02-08 09:22:30 -08:00
video mn10300: add the MN10300/AM33 architecture to the kernel 2008-02-08 09:22:30 -08:00
virtio virtio: add missing #include <linux/delay.h> 2008-02-06 10:41:21 -08:00
w1 DS1WM: decouple host IRQ and INTR active state settings 2008-02-07 08:42:06 -08:00
watchdog drivers/watchdog/: Spelling fixes 2008-02-03 17:32:52 +02:00
xen
zorro
Kconfig memstick: initial commit for Sony MemoryStick support 2008-02-09 11:08:34 -08:00
Makefile memstick: initial commit for Sony MemoryStick support 2008-02-09 11:08:34 -08:00