2006-02-26 14:59:35

by Karol Kozimor

[permalink] [raw]
Subject: [Bluez-devel] bug in hci_uart_tx_wakeup() causes panic when UART removed

Hi,
Under specific circumstances, hci_uart_tx_wakeup() seems to call
tty->driver->write() without checking if the tty is alive, which
effectively causes a nasty panic in uart_write(). From what I've read so
far it seems that hci_ldisc.c is to blame, so I'm reporting it here.

This is related to:
http://sourceforge.net/mailarchive/message.php?msg_id=14724441

See also:
http://bugme.osdl.org/show_bug.cgi?id=6131
http://bugzilla.kernel.org/show_bug.cgi?id=5958

Best regards,

--
Karol 'sziwan' Kozimor
[email protected]


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel


2006-02-26 23:58:09

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [Bluez-devel] Re: bug in hci_uart_tx_wakeup() causes panic when UART removed

Hi Russell,

> > Under specific circumstances, hci_uart_tx_wakeup() seems to call
> > tty->driver->write() without checking if the tty is alive, which
> > effectively causes a nasty panic in uart_write(). From what I've read so
> > far it seems that hci_ldisc.c is to blame, so I'm reporting it here.
> >
> > This is related to:
> > http://sourceforge.net/mailarchive/message.php?msg_id=14724441
> >
> > See also:
> > http://bugme.osdl.org/show_bug.cgi?id=6131
> > http://bugzilla.kernel.org/show_bug.cgi?id=5958
>
> As a priority, I especially recommend bluetooth developers read:
>
> http://bugzilla.kernel.org/show_bug.cgi?id=5958#c2
>
> where bug 6131 was predicted.

I saw that we didn't implement the hangup callback. Will it be
sufficient to use it to shutdown our HCI interface?

Regards

Marcel




-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2006-02-26 22:47:38

by Russell King

[permalink] [raw]
Subject: [Bluez-devel] Re: bug in hci_uart_tx_wakeup() causes panic when UART removed

On Sun, Feb 26, 2006 at 03:59:35PM +0100, Karol Kozimor wrote:
> Hi,
> Under specific circumstances, hci_uart_tx_wakeup() seems to call
> tty->driver->write() without checking if the tty is alive, which
> effectively causes a nasty panic in uart_write(). From what I've read so
> far it seems that hci_ldisc.c is to blame, so I'm reporting it here.
>
> This is related to:
> http://sourceforge.net/mailarchive/message.php?msg_id=14724441
>
> See also:
> http://bugme.osdl.org/show_bug.cgi?id=6131
> http://bugzilla.kernel.org/show_bug.cgi?id=5958

As a priority, I especially recommend bluetooth developers read:

http://bugzilla.kernel.org/show_bug.cgi?id=5958#c2

where bug 6131 was predicted.

--
Russell King


-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel

2006-02-26 21:40:26

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [Bluez-devel] bug in hci_uart_tx_wakeup() causes panic when UART removed

Hi Karol,

> Under specific circumstances, hci_uart_tx_wakeup() seems to call
> tty->driver->write() without checking if the tty is alive, which
> effectively causes a nasty panic in uart_write(). From what I've read so
> far it seems that hci_ldisc.c is to blame, so I'm reporting it here.

and I haven't seen a patch for it or any advice on how to fix this. At
the moment I have no time to fully track this down.

Regards

Marcel




-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642
_______________________________________________
Bluez-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bluez-devel