[PATCH 1/2] Bluetooth: Fix unsafe tx buffer count updates
From: Peter Hurley <hidden>
Date: 2011-08-30 13:22:23
Subsystem:
bluetooth subsystem, the rest · Maintainers:
Marcel Holtmann, Luiz Augusto von Dentz, Linus Torvalds
The tx tasklet and rx tasklet (if not currently running on this cpu) must be disabled to prevent concurrent access while updating the tx buffer counts. Signed-off-by: Peter Hurley <redacted> --- net/bluetooth/hci_conn.c | 8 ++++++-- 1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3e0a4b5..38993f6 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c@@ -359,6 +359,10 @@ int hci_conn_del(struct hci_conn *conn) del_timer(&conn->auto_accept_timer); + tasklet_disable(&hdev->tx_task); + if (!in_serving_softirq()) + tasklet_disable(&hdev->rx_task); + if (conn->type == ACL_LINK) { struct hci_conn *sco = conn->link; if (sco)
@@ -379,12 +383,12 @@ int hci_conn_del(struct hci_conn *conn) } } - tasklet_disable(&hdev->tx_task); - hci_conn_hash_del(hdev, conn); if (hdev->notify) hdev->notify(hdev, HCI_NOTIFY_CONN_DEL); + if (!in_serving_softirq()) + tasklet_enable(&hdev->rx_task); tasklet_enable(&hdev->tx_task); skb_queue_purge(&conn->data_q);
--
1.7.4.1