linux/net
Ilia Kolomisnky 05e9a2f678 Bluetooth: Fix crash with incoming L2CAP connections
Another regression fix considering incomming l2cap connections with
defer_setup enabled. In situations when incomming connection is
extracted with l2cap_sock_accept, it's bt_sock info will have
'parent' member zerroed, but 'parent' may be used unconditionally
in l2cap_conn_start() and l2cap_security_cfm() when defer_setup
is enabled.

Backtrace:
[<bf02d5ac>] (l2cap_security_cfm+0x0/0x2ac [bluetooth]) from [<bf01f01c>] (hci_event_pac
ket+0xc2c/0x4aa4 [bluetooth])
[<bf01e3f0>] (hci_event_packet+0x0/0x4aa4 [bluetooth]) from [<bf01a844>] (hci_rx_task+0x
cc/0x27c [bluetooth])
[<bf01a778>] (hci_rx_task+0x0/0x27c [bluetooth]) from [<c008eee4>] (tasklet_action+0xa0/
0x15c)
[<c008ee44>] (tasklet_action+0x0/0x15c) from [<c008f38c>] (__do_softirq+0x98/0x130)
 r7:00000101 r6:00000018 r5:00000001 r4:efc46000
[<c008f2f4>] (__do_softirq+0x0/0x130) from [<c008f524>] (do_softirq+0x4c/0x58)
[<c008f4d8>] (do_softirq+0x0/0x58) from [<c008f5e0>] (run_ksoftirqd+0xb0/0x1b4)
 r4:efc46000 r3:00000001
[<c008f530>] (run_ksoftirqd+0x0/0x1b4) from [<c009f2a8>] (kthread+0x84/0x8c)
 r7:00000000 r6:c008f530 r5:efc47fc4 r4:efc41f08
[<c009f224>] (kthread+0x0/0x8c) from [<c008cc84>] (do_exit+0x0/0x5f0)

Signed-off-by: Ilia Kolomisnky <iliak@ti.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: David S. Miller <davem@davemloft.net>
2011-07-16 10:14:44 -07:00
..
9p Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband 2011-05-26 12:13:57 -07:00
802
8021q net: remove NETIF_F_ALL_TX_OFFLOADS 2011-07-14 15:18:49 -07:00
appletalk
atm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2011-05-27 11:16:27 -07:00
ax25
batman-adv
bluetooth Bluetooth: Fix crash with incoming L2CAP connections 2011-07-16 10:14:44 -07:00
bridge bridge: Always flood broadcast packets 2011-07-05 18:39:39 -07:00
caif caif: Bugfix - XOFF removed channel from caif-mux 2011-06-16 23:59:09 -04:00
can can: convert to %pK for kptr_restrict support 2011-05-26 14:23:35 -04:00
ceph libceph: fix page calculation for non-page-aligned io 2011-06-13 16:26:17 -07:00
core ipv6: Don't put artificial limit on routing table size. 2011-07-01 17:30:43 -07:00
dcb
dccp
decnet
dns_resolver
dsa
econet
ethernet
ieee802154 ieee802154: Don't leak memory in ieee802154_nl_fill_phy 2011-06-13 18:03:22 -04:00
ipv4 net: refine {udp|tcp|sctp}_mem limits 2011-07-07 00:27:05 -07:00
ipv6 net: bind() fix error return on wrong address family 2011-07-04 21:37:41 -07:00
ipx
irda irda: iriap: Use seperate lockdep class for irias_objects->hb_spinlock 2011-06-06 17:00:35 -07:00
iucv [S390] irq: merge irq.c and s390_ext.c 2011-05-26 09:48:24 +02:00
key
l2tp fix return values of l2tp_dfs_seq_open() 2011-06-05 14:11:09 -07:00
lapb
llc
mac80211 mac80211: fix TKIP replay vulnerability 2011-07-07 13:06:09 -04:00
netfilter netfilter: fix looped (broad|multi)cast's MAC handling 2011-06-16 17:27:04 +02:00
netlabel
netlink
netrom
packet af_packet: prevent information leak 2011-06-06 22:42:06 -07:00
phonet
rds RDMA/cma: Pass QP type into rdma_create_id() 2011-05-25 13:46:23 -07:00
rfkill
rose
rxrpc
sched net: Rework netdev_drivername() to avoid warning. 2011-06-06 16:41:33 -07:00
sctp net: sctp: fix checksum marking for outgoing packets 2011-07-14 15:16:31 -07:00
sunrpc SUNRPC: Fix use of static variable in rpcb_getport_async 2011-07-12 13:40:13 -04:00
tipc
unix
wanrouter
wimax
wireless cfg80211: fix deadlock with rfkill/sched_scan by adding new mutex 2011-07-05 14:42:36 -04:00
x25
xfrm XFRM: Fix memory leak in xfrm_state_update 2011-07-08 08:58:42 -07:00
compat.c
Kconfig
Makefile
nonet.c
socket.c
sysctl_net.c
TUNABLE