Jiri Slaby
13407376b2
Bluetooth: vhci: purge unhandled skbs
The write handler allocates skbs and queues them into data->readq.
Read side should read them, if there is any. If there is none, skbs
should be dropped by hdev->flush. But this happens only if the device
is HCI_UP, i.e. hdev->power_on work was triggered already. When it was
not, skbs stay allocated in the queue when /dev/vhci is closed. So
purge the queue in ->release.
Program to reproduce:
#include <err.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/uio.h>
int main()
{
char buf[] = { 0xff, 0 };
struct iovec iov = {
.iov_base = buf,
.iov_len = sizeof(buf),
};
int fd;
while (1) {
fd = open("/dev/vhci", O_RDWR);
if (fd < 0)
err(1, "open");
usleep(50);
if (writev(fd, &iov, 1) < 0)
err(1, "writev");
usleep(50);
close(fd);
}
return 0;
}
Result:
kmemleak: 4609 new suspected memory leaks
unreferenced object 0xffff88059f4d5440 (size 232):
comm "vhci", pid 1084, jiffies 4294912542 (age 37569.296s)
hex dump (first 32 bytes):
20 f0 23 87 05 88 ff ff 20 f0 23 87 05 88 ff ff .#..... .#.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
...
[<ffffffff81ece010>] __alloc_skb+0x0/0x5a0
[<ffffffffa021886c>] vhci_create_device+0x5c/0x580 [hci_vhci]
[<ffffffffa0219436>] vhci_write+0x306/0x4c8 [hci_vhci]
Fixes: 23424c0d31 (Bluetooth: Add support creating virtual AMP controllers)
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: stable 3.13+ <stable@vger.kernel.org>
2016-04-08 19:22:46 +02:00
..
2016-04-02 01:17:36 +02:00
2016-03-18 20:06:46 -07:00
2016-03-17 21:38:27 -07:00
2016-03-24 22:59:58 -07:00
2016-03-26 15:53:16 -07:00
2016-04-08 19:22:46 +02:00
2016-03-21 13:14:16 -07:00
2016-03-25 09:02:13 -07:00
2016-03-29 16:31:16 -07:00
2016-03-24 10:32:42 -07:00
2016-03-24 22:59:58 -07:00
2016-03-21 15:50:28 +01:00
2016-03-23 06:12:39 -07:00
2016-03-17 02:30:16 +01:00
2016-03-24 23:13:48 -07:00
2016-03-21 09:26:45 +01:00
2016-03-16 08:36:55 -07:00
2016-03-25 08:52:25 -07:00
2016-03-22 15:36:02 -07:00
2016-03-30 10:39:39 +02:00
2016-04-01 13:22:33 +10:00
2016-03-22 15:36:02 -07:00
2016-03-17 13:47:50 -07:00
2016-03-27 10:37:48 -07:00
2016-03-22 12:47:40 -07:00
2016-03-20 16:59:27 -04:00
2016-03-23 16:19:38 -04:00
2016-03-18 10:15:11 -07:00
2016-03-23 15:57:39 -07:00
2016-03-25 16:59:11 -07:00
2016-03-22 11:57:43 -07:00
2016-03-23 12:02:29 +01:00
2016-03-27 22:38:12 -04:00
2016-03-23 17:20:59 -07:00
2016-03-18 18:10:38 -07:00
2016-03-23 06:09:15 -07:00
2016-03-21 14:18:10 -07:00
2016-03-21 13:49:01 -07:00
2016-03-24 19:57:15 -07:00
2016-03-25 16:37:42 -07:00
2016-03-18 10:15:11 -07:00
2016-03-20 19:08:56 -07:00
2016-03-21 14:35:52 -07:00
2016-03-24 19:57:15 -07:00
2016-04-04 16:24:13 -04:00
2016-03-19 10:05:34 -07:00
2016-03-26 11:44:33 -04:00
2016-03-28 17:19:31 -07:00
2016-03-22 10:27:29 -06:00
2016-03-19 15:15:07 -07:00
2016-03-16 14:45:55 -07:00
2016-03-22 07:50:11 -05:00
2016-03-21 11:36:17 +00:00
2016-03-18 19:26:54 -07:00
2016-03-23 17:20:59 -07:00
2016-03-25 16:55:37 -07:00
2016-03-15 12:13:56 -07:00
2016-03-23 17:11:48 +01:00
2016-03-22 15:36:02 -07:00
2016-03-18 10:15:11 -07:00
2016-03-24 22:49:08 -07:00
2016-04-01 07:15:54 -05:00
2016-03-26 11:31:01 -07:00
2016-03-20 15:40:32 -07:00
2016-03-17 12:34:54 -07:00
2016-03-25 08:48:31 -07:00
2016-03-22 12:41:14 -07:00
2016-03-18 14:10:57 +08:00
2016-03-22 12:55:17 -07:00
2016-03-23 06:06:45 -07:00
2016-03-17 13:05:09 -07:00
2016-03-22 12:41:14 -07:00
2016-03-23 06:06:45 -07:00
2016-03-20 13:28:18 -07:00
2016-03-22 15:36:02 -07:00
2016-03-22 12:55:17 -07:00