Bluetooth : Ignore incomming events when the hci device is down

In error conditions Adapter state machine via Bluez tries to reset the hci device, during that in some rare scenario if some pending event comes from riva, the command complete apis tries to access some already freed memory in reset sequence. CRs-fixed: 369658 Signed-off-by: Bhasker Neti <[email protected]> (cherry picked from commit 6f4ceb1) Signed-off-by: Ramakrishna Prasad N <[email protected]> (cherry picked from commit d686446) Signed-off-by: Ramakrishna Prasad N <[email protected]> (cherry picked from commit 69c592d) Change-Id: Ic4cb65d405a4928b5a45aaad9c1d8ad1f6e67907 Signed-off-by: Shruthi Krishna <[email protected]>
shr-distribution · Aug 3, 2012 · 4a9bceb · 4a9bceb
1 parent fc4df71
commit 4a9bceb
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
@@ -2036,6 +2036,9 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
 
 	opcode = __le16_to_cpu(ev->opcode);
 
+	if (test_bit(HCI_RESET, &hdev->flags) && (opcode != HCI_OP_RESET))
+		return;
+
 	switch (opcode) {
 	case HCI_OP_INQUIRY_CANCEL:
 		hci_cc_inquiry_cancel(hdev, skb);