tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

bluetooth: fix list handling

Commit 835a6a2f8603 ("Bluetooth: Stop sabotaging list poisoning")
thought that the code was sabotaging the list poisoning when NULL'ing
out the list pointers and removed it.

But what was going on was that the bluetooth code was using NULL
pointers for the list as a way to mark it empty, and that commit just
broke it (and replaced the test with NULL with a "list_empty()" test on
a uninitialized list instead, breaking things even further).

So fix it all up to use the regular and real list_empty() handling
(which does not use NULL, but a pointer to itself), also making sure to
initialize the list properly (the previous NULL case was initialized
implicitly by the session being allocated with kzalloc())

This is a combination of patches by Marcel Holtmann and Tedd Ho-Jeong
An.

[ I would normally expect to get this through the bt tree, but I'm going
to release -rc1, so I'm just committing this directly - Linus ]

Reported-and-tested-by: Jörg Otte <jrg.otte@gmail.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Original-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Original-by: Marcel Holtmann <marcel@holtmann.org>:
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Linus Torvalds 9b284cbd 5c755fe1

+3 -2
+1
net/bluetooth/hidp/core.c
··· 915 915 session->conn = l2cap_conn_get(conn); 916 916 session->user.probe = hidp_session_probe; 917 917 session->user.remove = hidp_session_remove; 918 + INIT_LIST_HEAD(&session->user.list); 918 919 session->ctrl_sock = ctrl_sock; 919 920 session->intr_sock = intr_sock; 920 921 skb_queue_head_init(&session->ctrl_transmit);
+2 -2
net/bluetooth/l2cap_core.c
··· 1634 1634 if (list_empty(&user->list)) 1635 1635 goto out_unlock; 1636 1636 1637 - list_del(&user->list); 1637 + list_del_init(&user->list); 1638 1638 user->remove(conn, user); 1639 1639 1640 1640 out_unlock: ··· 1648 1648 1649 1649 while (!list_empty(&conn->users)) { 1650 1650 user = list_first_entry(&conn->users, struct l2cap_user, list); 1651 - list_del(&user->list); 1651 + list_del_init(&user->list); 1652 1652 user->remove(conn, user); 1653 1653 } 1654 1654 }