From: Gustavo F. Padovan <padovan@profusion.mobi>
Date: Tue, 15 Feb 2011 23:22:03 +0000 (-0300)
Subject: Bluetooth: Fix crash when ioctl(HCIUARTSETPROTO) fails
X-Git-Tag: v2.6.39-rc1~468^2~238^2^2~45^2~11
X-Git-Url: https://openfabrics.org/gitweb/?a=commitdiff_plain;h=c6f3c5f7f2938d2809bcc15889e9aa212038a554;p=~emulex%2Finfiniband.git

Bluetooth: Fix crash when ioctl(HCIUARTSETPROTO) fails

If the fail happens the HCI del_timer may timeout after the the hci dev
unregister. This lead to a kernel crash.

Reported-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
---

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 173bebd4282..c01415bc894 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1199,6 +1199,8 @@ int hci_unregister_dev(struct hci_dev *hdev)
 
 	hci_unregister_sysfs(hdev);
 
+	hci_del_off_timer(hdev);
+
 	destroy_workqueue(hdev->workqueue);
 
 	hci_dev_lock_bh(hdev);