2011-08-30 13:22:23

by Peter Hurley

[permalink] [raw]
Subject: [PATCH 1/2] Bluetooth: Fix unsafe tx buffer count updates

The tx tasklet and rx tasklet (if not currently running on this cpu)
must be disabled to prevent concurrent access while updating the
tx buffer counts.

Signed-off-by: Peter Hurley <[email protected]>
---
net/bluetooth/hci_conn.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3e0a4b5..38993f6 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -359,6 +359,10 @@ int hci_conn_del(struct hci_conn *conn)

del_timer(&conn->auto_accept_timer);

+ tasklet_disable(&hdev->tx_task);
+ if (!in_serving_softirq())
+ tasklet_disable(&hdev->rx_task);
+
if (conn->type == ACL_LINK) {
struct hci_conn *sco = conn->link;
if (sco)
@@ -379,12 +383,12 @@ int hci_conn_del(struct hci_conn *conn)
}
}

- tasklet_disable(&hdev->tx_task);
-
hci_conn_hash_del(hdev, conn);
if (hdev->notify)
hdev->notify(hdev, HCI_NOTIFY_CONN_DEL);

+ if (!in_serving_softirq())
+ tasklet_enable(&hdev->rx_task);
tasklet_enable(&hdev->tx_task);

skb_queue_purge(&conn->data_q);
--
1.7.4.1