diff options
| author |   Johan Hedberg <johan.hedberg@intel.com> | 2012-06-06 18:44:11 +0800 |
|---|---|---|
| committer |   Gustavo Padovan <gustavo.padovan@collabora.co.uk> | 2012-06-08 03:23:56 -0300 |
| commit | d06cc416f517a25713dedd9e2a9ccf4f3086c09a (patch) | |
| tree | 4faf0f0e7f32bc66705f75d3f82d8db503e93741 /net/bluetooth | |
| parent | Bluetooth: Fix LE pairing completion on connection failure (diff) | |
| download | linux-dev-d06cc416f517a25713dedd9e2a9ccf4f3086c09a.tar.xz linux-dev-d06cc416f517a25713dedd9e2a9ccf4f3086c09a.zip | |
Bluetooth: Fix deadlock and crash when SMP pairing times out
The l2cap_conn_del function tries to cancel_sync the security timer, but
when it's called from the timeout function itself a deadlock occurs.
Subsequently the "hcon->l2cap_data = NULL" that's supposed to protect
multiple calls to l2cap_conn_del never gets cleared and when the
connection finally drops we double free's etc which will crash the
kernel.
This patch fixes the issue by using the HCI_CONN_LE_SMP_PEND for
protecting against this. The same flag is also used for the same purpose
in other places in the SMP code.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 24f144b72a96..8394e3615ef6 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1295,7 +1295,12 @@ static void security_timeout(struct work_struct *work) struct l2cap_conn *conn = container_of(work, struct l2cap_conn, security_timer.work); - l2cap_conn_del(conn->hcon, ETIMEDOUT); + BT_DBG("conn %p", conn); + + if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) { + smp_chan_destroy(conn); + l2cap_conn_del(conn->hcon, ETIMEDOUT); + } } static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status) |