Return-Path: <cyrus@holtmann.org>
Date: Wed, 29 Jul 2015 14:38:21 +0200
From: Alexander Aring <alex.aring@gmail.com>
To: jukka.rissanen@linux.intel.com
Cc: linux-bluetooth@vger.kernel.org, kernel@pengutronix.de
Subject: btle 6lowpan races
Message-ID: <20150729123802.GA31129@omega>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Sender: linux-bluetooth-owner@vger.kernel.org
List-ID: <linux-bluetooth.vger.kernel.org>

Hi Jukka,

I think it's bad for filling data for btle lowpan private data at point [0].
This is called after register_netdev and the rtnl_lock isn't hold after
calling "register_netdev" anymore which ends in a possible interface up
between register and filling lowpan_dev information. The result would be
that lowpan_dev is readed somewhere where it isn't filled.

The solution would be simple move the filling between alloc and register of
netdev.

If you like I can prepare patches for that.

Any thoughts on this?

- Alex

[0] http://lxr.free-electrons.com/source/net/bluetooth/6lowpan.c#L874