[lkml]   [2009]   [Feb]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] Bluetooth USB: fix kernel panic during suspend - 2.6.24

The kernel panics when hci_usb_tx_complete() calls _urb_unlink()
on an _urb which has been previously been removed from a list.
This occurs during suspend while audio is being streamed to
a bluetooth headset.

The panic occurs because hci_usb_suspend() dequeues _urb
and then calls usb_kill_urb() - instead it should put _urb on
the killed list first before killing the urb.

Also added a spin_lock around the list_add operation.

Signed-off-by: Colin Ian King <>
drivers/bluetooth/hci_usb.c | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index cf734ca..22fd5b5 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -1029,8 +1029,10 @@ static int hci_usb_suspend(struct usb_interface
*intf, pm_message_t message)
while ((_urb = _urb_dequeue(q))) {
/* reset queue since _urb_dequeue sets it to NULL */
_urb->queue = q;
- usb_kill_urb(&_urb->urb);
+ spin_lock_irqsave(&q->lock, flags);
list_add(&_urb->list, &killed);
+ spin_unlock_irqrestore(&q->lock, flags);
+ usb_kill_urb(&_urb->urb);

spin_lock_irqsave(&q->lock, flags);

 \ /
  Last update: 2009-02-13 10:53    [W:0.044 / U:7.812 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site