kernel-fxtec-pro1x/net/bluetooth
Douglas Anderson 3bd7594e69 Bluetooth: hci_core: Avoid mixing up req_complete and req_complete_skb
In commit 44d2713774 ("Bluetooth: Compress the size of struct
hci_ctrl") we squashed down the size of the structure by using a union
with the assumption that all users would use the flag to determine
whether we had a req_complete or a req_complete_skb.

Unfortunately we had a case in hci_req_cmd_complete() where we weren't
looking at the flag.  This can result in a situation where we might be
storing a hci_req_complete_skb_t in a hci_req_complete_t variable, or
vice versa.

During some testing I found at least one case where the function
hci_req_sync_complete() was called improperly because the kernel thought
that it didn't require an SKB.  Looking through the stack in kgdb I
found that it was called by hci_event_packet() and that
hci_event_packet() had both of its locals "req_complete" and
"req_complete_skb" pointing to the same place: both to
hci_req_sync_complete().

Let's make sure we always check the flag.

For more details on debugging done, see <http://crbug.com/588288>.

Fixes: 44d2713774 ("Bluetooth: Compress the size of struct hci_ctrl")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
2016-02-20 08:52:28 +01:00
..
bnep Bluetooth: Do not filter multicast addresses by default 2015-12-11 10:46:16 +01:00
cmtp Bluetooth: use list_for_each_entry* 2015-12-20 08:11:10 +01:00
hidp Bluetooth: hidp: fix device disconnect on idle timeout 2015-10-21 00:49:23 +02:00
rfcomm Bluetooth: use list_for_each_entry* 2015-12-20 08:11:10 +01:00
6lowpan.c Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets 2016-01-23 12:25:53 +00:00
a2mp.c Bluetooth: Move get info completed callback to a2mp.c 2015-07-30 13:37:22 +02:00
a2mp.h Bluetooth: Add BT_HS config option 2015-07-30 13:31:59 +02:00
af_bluetooth.c Bluetooth: use list_for_each_entry* 2015-12-20 08:11:10 +01:00
amp.c Bluetooth: Fix breakage in amp_write_rem_assoc_frag() 2015-08-10 20:41:34 +02:00
amp.h Bluetooth: Add BT_HS config option 2015-07-30 13:31:59 +02:00
ecc.c Bluetooth: Add ECC library for LE Secure Connections 2014-12-03 16:51:16 +01:00
ecc.h Bluetooth: Add ECC library for LE Secure Connections 2014-12-03 16:51:16 +01:00
hci_conn.c Bluetooth: Don't treat connection timeout as a failure 2015-12-10 00:51:51 +01:00
hci_core.c Bluetooth: hci_core: Avoid mixing up req_complete and req_complete_skb 2016-02-20 08:52:28 +01:00
hci_debugfs.c Bluetooth: Expose current Device ID information via debugfs 2015-04-02 08:40:35 +03:00
hci_debugfs.h Bluetooth: Provide option to enable/disable debugfs information 2015-02-15 18:54:13 +02:00
hci_event.c Bluetooth: Change eir_has_data_type() to more generic eir_get_data() 2016-01-05 17:02:49 +01:00
hci_request.c Bluetooth: Fix incorrect removing of IRKs 2016-01-29 11:47:24 +01:00
hci_request.h Bluetooth: Clean up current advertising instance tracking 2015-12-10 00:51:50 +01:00
hci_sock.c Bluetooth: avoid rebuilding hci_sock all the time 2016-01-06 16:36:44 +01:00
hci_sysfs.c
Kconfig Bluetooth: Add BT_HS config option 2015-07-30 13:31:59 +02:00
l2cap_core.c Bluetooth: L2CAP: Fix auto-allocating LE PSM values 2016-01-29 11:47:24 +01:00
l2cap_sock.c Bluetooth: L2CAP: Fix setting chan src info before adding PSM/CID 2016-01-29 11:47:24 +01:00
lib.c Bluetooth: Add BT_WARN and bt_dev_warn logging macros 2015-09-24 16:25:44 +02:00
Makefile Bluetooth: Add BT_HS config option 2015-07-30 13:31:59 +02:00
mgmt.c Bluetooth: Add support for Start Limited Discovery command 2016-01-05 17:02:50 +01:00
mgmt_util.c Bluetooth: Add generic mgmt helper API 2015-03-17 18:03:08 +01:00
mgmt_util.h Bluetooth: Add generic mgmt helper API 2015-03-17 18:03:08 +01:00
sco.c bluetooth: Validate socket address length in sco_sock_bind(). 2015-12-15 15:39:08 -05:00
selftest.c Bluetooth: Export ECDH selftest result in debugfs 2015-04-02 08:47:38 +03:00
selftest.h Bluetooth: Add support for self testing framework 2014-12-30 08:53:55 +02:00
smp.c Bluetooth: Fix incorrect removing of IRKs 2016-01-29 11:47:24 +01:00
smp.h Bluetooth: Fix crash in SMP when unpairing 2015-10-22 09:02:03 +02:00