Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Quel Qun]

 -------------- Original message ----------------------
From: David Miller <davem@davemloft.net>
> From: Marcel Holtmann <marcel@holtmann.org>
> Date: Wed, 27 Feb 2008 10:55:07 +0100
> 
> > Hi Dave,
> > 
> > > From: Thomas Gleixner <tglx@linutronix.de>
> > > Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
> > >
> > >> Delete a possibly armed timer before kfree'ing the connection object.
> > >>
> > >> Solves: http://lkml.org/lkml/2008/2/15/514
> > >>
> > >> Reported-by:Quel Qun <kelk1@comcast.net>
> > >> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> > >
> > > I'll apply this, thanks Thomas.
> > 
> > can you please wait for a confirmation from Quel that this fixes it.  
> > My ACK is based on that he confirms that it fixes it for sure.
> 
> It doesn't hurt to toss this to Linus now, if it's bogus we
> have tons of time to revert it.

As I said, it prevents the crash, but does not 'fix' my problem, in that I still cannot use the dongle.
--
kk1

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Thomas Gleixner]

On Wed, 27 Feb 2008, Quel Qun wrote:
> > > > I'll apply this, thanks Thomas.
> > > 
> > > can you please wait for a confirmation from Quel that this fixes it.  
> > > My ACK is based on that he confirms that it fixes it for sure.
> > 
> > It doesn't hurt to toss this to Linus now, if it's bogus we
> > have tons of time to revert it.
>
> As I said, it prevents the crash, but does not 'fix' my problem, in
> that I still cannot use the dongle.

The disfunctionality of your dongle is a separate problem and I hope
that the bluetooth wizards will help you to get this sucker running.

The timer which is not deactivated before the data structure
containing it is a simple bug, which needs to be addressed ASAP.

Thanks again for your patience in tracking this down,

	tglx

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Quel Qun]

 -------------- Original message ----------------------
From: David Miller <davem@davemloft.net>
> 
> Marcel/Dave, can you or someone else followup with
> the bug reporter to get their dongle working now that
> the OOPS problem is fixed?
> 
> Let's not lose track of this bug, thanks.

I entered #10126

http://bugzilla.kernel.org/show_bug.cgi?id=10126

Thank you,
--
kk1

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[David Miller]

Marcel/Dave, can you or someone else followup with
the bug reportor to get their dongle working now that
the OOPS problem is fixed?

Let's not lose track of this bug, thanks.

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[David Miller]

From: Marcel Holtmann <marcel@holtmann.org>
Date: Wed, 27 Feb 2008 10:55:07 +0100

> Hi Dave,
> 
> > From: Thomas Gleixner <tglx@linutronix.de>
> > Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
> >
> >> Delete a possibly armed timer before kfree'ing the connection object.
> >>
> >> Solves: http://lkml.org/lkml/2008/2/15/514
> >>
> >> Reported-by:Quel Qun <kelk1@comcast.net>
> >> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> >
> > I'll apply this, thanks Thomas.
> 
> can you please wait for a confirmation from Quel that this fixes it.  
> My ACK is based on that he confirms that it fixes it for sure.

It doesn't hurt to toss this to Linus now, if it's bogus we
have tons of time to revert it.

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Thomas Gleixner]

On Wed, 27 Feb 2008, Marcel Holtmann wrote:

> Hi Dave,
> 
> > From: Thomas Gleixner <tglx@linutronix.de>
> > Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
> > 
> > > Delete a possibly armed timer before kfree'ing the connection object.
> > > 
> > > Solves: http://lkml.org/lkml/2008/2/15/514
> > > 
> > > Reported-by:Quel Qun <kelk1@comcast.net>
> > > Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> > 
> > I'll apply this, thanks Thomas.
> 
> can you please wait for a confirmation from Quel that this fixes it. My ACK is
> based on that he confirms that it fixes it for sure.

http://lkml.org/lkml/2008/2/25/463

Thanks,

	tglx

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Marcel Holtmann]

Hi Dave,

> From: Thomas Gleixner <tglx@linutronix.de>
> Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
>
>> Delete a possibly armed timer before kfree'ing the connection object.
>>
>> Solves: http://lkml.org/lkml/2008/2/15/514
>>
>> Reported-by:Quel Qun <kelk1@comcast.net>
>> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
>
> I'll apply this, thanks Thomas.

can you please wait for a confirmation from Quel that this fixes it.  
My ACK is based on that he confirms that it fixes it for sure.

Regards

Marcel

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[David Miller]

From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)

> Delete a possibly armed timer before kfree'ing the connection object.
> 
> Solves: http://lkml.org/lkml/2008/2/15/514
> 
> Reported-by:Quel Qun <kelk1@comcast.net>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

I'll apply this, thanks Thomas.

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Marcel Holtmann]

Hi Quel,

> Delete a possibly armed timer before kfree'ing the connection object.
>
> Solves: http://lkml.org/lkml/2008/2/15/514
>
> Reported-by:Quel Qun <kelk1@comcast.net>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
>
> ---
> net/bluetooth/l2cap.c |    2 ++
> 1 file changed, 2 insertions(+)
>
> Index: linux-2.6/net/bluetooth/l2cap.c
> ===================================================================
> --- linux-2.6.orig/net/bluetooth/l2cap.c
> +++ linux-2.6/net/bluetooth/l2cap.c
> @@ -417,6 +417,8 @@ static void l2cap_conn_del(struct hci_co
> 		l2cap_sock_kill(sk);
> 	}
>
> +	del_timer_sync(&conn->info_timer);
> +
> 	hcon->l2cap_data = NULL;
> 	kfree(conn);
> }

can you confirm that this actually fixes the issue.

Thomas, if confirmed, this is Acked-by me.

Regards

Marcel

[PATCH] bluetooth: delete timer in l2cap_conn_del()

[Thomas Gleixner]

Delete a possibly armed timer before kfree'ing the connection object.

Solves: http://lkml.org/lkml/2008/2/15/514

Reported-by:Quel Qun <kelk1@comcast.net>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

---
 net/bluetooth/l2cap.c |    2 ++
 1 file changed, 2 insertions(+)

Index: linux-2.6/net/bluetooth/l2cap.c
===================================================================
--- linux-2.6.orig/net/bluetooth/l2cap.c
+++ linux-2.6/net/bluetooth/l2cap.c
@@ -417,6 +417,8 @@ static void l2cap_conn_del(struct hci_co
 		l2cap_sock_kill(sk);
 	}
 
+	del_timer_sync(&conn->info_timer);
+
 	hcon->l2cap_data = NULL;
 	kfree(conn);
 }