Commit 9b284cbd authored by Linus Torvalds's avatar Linus Torvalds

bluetooth: fix list handling

Commit 835a6a2f ("Bluetooth: Stop sabotaging list poisoning")
thought that the code was sabotaging the list poisoning when NULL'ing
out the list pointers and removed it.

But what was going on was that the bluetooth code was using NULL
pointers for the list as a way to mark it empty, and that commit just
broke it (and replaced the test with NULL with a "list_empty()" test on
a uninitialized list instead, breaking things even further).

So fix it all up to use the regular and real list_empty() handling
(which does not use NULL, but a pointer to itself), also making sure to
initialize the list properly (the previous NULL case was initialized
implicitly by the session being allocated with kzalloc())

This is a combination of patches by Marcel Holtmann and Tedd Ho-Jeong
An.

[ I would normally expect to get this through the bt tree, but I'm going
  to release -rc1, so I'm just committing this directly   - Linus ]
Reported-and-tested-by: default avatarJörg Otte <jrg.otte@gmail.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Original-by: default avatarTedd Ho-Jeong An <tedd.an@intel.com>
Original-by: Marcel Holtmann <marcel@holtmann.org>:
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5c755fe1
...@@ -915,6 +915,7 @@ static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr, ...@@ -915,6 +915,7 @@ static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr,
session->conn = l2cap_conn_get(conn); session->conn = l2cap_conn_get(conn);
session->user.probe = hidp_session_probe; session->user.probe = hidp_session_probe;
session->user.remove = hidp_session_remove; session->user.remove = hidp_session_remove;
INIT_LIST_HEAD(&session->user.list);
session->ctrl_sock = ctrl_sock; session->ctrl_sock = ctrl_sock;
session->intr_sock = intr_sock; session->intr_sock = intr_sock;
skb_queue_head_init(&session->ctrl_transmit); skb_queue_head_init(&session->ctrl_transmit);
......
...@@ -1634,7 +1634,7 @@ void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) ...@@ -1634,7 +1634,7 @@ void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
if (list_empty(&user->list)) if (list_empty(&user->list))
goto out_unlock; goto out_unlock;
list_del(&user->list); list_del_init(&user->list);
user->remove(conn, user); user->remove(conn, user);
out_unlock: out_unlock:
...@@ -1648,7 +1648,7 @@ static void l2cap_unregister_all_users(struct l2cap_conn *conn) ...@@ -1648,7 +1648,7 @@ static void l2cap_unregister_all_users(struct l2cap_conn *conn)
while (!list_empty(&conn->users)) { while (!list_empty(&conn->users)) {
user = list_first_entry(&conn->users, struct l2cap_user, list); user = list_first_entry(&conn->users, struct l2cap_user, list);
list_del(&user->list); list_del_init(&user->list);
user->remove(conn, user); user->remove(conn, user);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment