Commit 384943ec authored May 08, 2009 by Marcel Holtmann

Bluetooth: Fix wrong module refcount when connection setup fails



The module refcount is increased by hci_dev_hold() call in hci_conn_add()
and decreased by hci_dev_put() call in del_conn(). In case the connection
setup fails, hci_dev_put() is never called.

Procedure to reproduce the issue:

  # hciconfig hci0 up
  # lsmod | grep btusb                   -> "used by" refcount = 1

  # hcitool cc <non-exisiting bdaddr>    -> will get timeout

  # lsmod | grep btusb                   -> "used by" refcount = 2
  # hciconfig hci0 down
  # lsmod | grep btusb                   -> "used by" refcount = 1
  # rmmod btusb                          -> ERROR: Module btusb is in use

The hci_dev_put() call got moved into del_conn() with the 2.6.25 kernel
to fix an issue with hci_dev going away before hci_conn. However that
change was wrong and introduced this problem.

When calling hci_conn_del() it has to call hci_dev_put() after freeing
the connection details. This handling should be fully symmetric. The
execution of del_conn() is done in a work queue and needs it own calls
to hci_dev_hold() and hci_dev_put() to ensure that the hci_dev stays
until the connection cleanup has been finished.

Based on a report by Bing Zhao <bzhao@marvell.com>

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Tested-by: Bing Zhao <bzhao@marvell.com>

parent e1cc1c57

net/bluetooth/hci_conn.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -292,6 +292,8 @@ int hci_conn_del(struct hci_conn *conn)

		hci_conn_del_sysfs(conn);

		hci_dev_put(hdev);

		return 0;
		}

net/bluetooth/hci_sysfs.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -99,6 +99,8 @@ static void add_conn(struct work_struct *work)
		BT_ERR("Failed to register connection device");
		return;
		}

		hci_dev_hold(hdev);
		}

		/*
		@@ -134,6 +136,7 @@ static void del_conn(struct work_struct *work)

		device_del(&conn->dev);
		put_device(&conn->dev);

		hci_dev_put(hdev);
		}

Admin message