Hermes Zhang e6a57d22f7 Bluetooth: hci_ldisc: Free rw_semaphore on close ... The percpu_rw_semaphore is not currently freed, and this leads to a crash when the stale rcu callback is invoked. DEBUG_OBJECTS detects this. ODEBUG: free active (active state 1) object type: rcu_head hint: (null) ------------[ cut here ]------------ WARNING: CPU: 1 PID: 2024 at debug_print_object+0xac/0xc8 PC is at debug_print_object+0xac/0xc8 LR is at debug_print_object+0xac/0xc8 Call trace: [<ffffff80082e2c2c>] debug_print_object+0xac/0xc8 [<ffffff80082e40b0>] debug_check_no_obj_freed+0x1e8/0x228 [<ffffff8008191254>] kfree+0x1cc/0x250 [<ffffff80083cc03c>] hci_uart_tty_close+0x54/0x108 [<ffffff800832e118>] tty_ldisc_close.isra.1+0x40/0x58 [<ffffff800832e14c>] tty_ldisc_kill+0x1c/0x40 [<ffffff800832e3dc>] tty_ldisc_release+0x94/0x170 [<ffffff8008325554>] tty_release_struct+0x1c/0x58 [<ffffff8008326400>] tty_release+0x3b0/0x490 [<ffffff80081a3fe8>] __fput+0x88/0x1d0 [<ffffff80081a418c>] ____fput+0xc/0x18 [<ffffff80080c0624>] task_work_run+0x9c/0xc0 [<ffffff80080a9e24>] do_exit+0x24c/0x8a0 [<ffffff80080aa4e0>] do_group_exit+0x38/0xa0 [<ffffff80080aa558>] __wake_up_parent+0x0/0x28 [<ffffff8008082c00>] el0_svc_naked+0x34/0x38 ---[ end trace bfe08cbd89098cdf ]--- Signed-off-by: Hermes Zhang <chenhuiz@axis.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>		2018-09-11 13:33:57 +02:00
..
ath3k.c
bcm203x.c
bfusb.c
bluecard_cs.c
bpa10x.c
bt3c_cs.c
btbcm.c
btbcm.h
btintel.c
btintel.h
btmrvl_debugfs.c
btmrvl_drv.h
btmrvl_main.c
btmrvl_sdio.c
btmrvl_sdio.h
btmtkuart.c
btqca.c
btqca.h
btqcomsmd.c
btrsi.c
btrtl.c
btrtl.h
btsdio.c
btusb.c
btwilink.c
dtl1_cs.c
h4_recv.h
hci_ag6xx.c
hci_ath.c
hci_bcm.c
hci_bcsp.c
hci_h4.c
hci_h5.c
hci_intel.c
hci_ldisc.c	Bluetooth: hci_ldisc: Free rw_semaphore on close	2018-09-11 13:33:57 +02:00
hci_ll.c
hci_mrvl.c
hci_nokia.c
hci_qca.c
hci_serdev.c
hci_uart.h
hci_vhci.c
Kconfig
Makefile