From patchwork Mon Apr 20 13:51:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?St=C3=A9phane_Cerveau?= X-Patchwork-Id: 11499025 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2520914DD for ; Mon, 20 Apr 2020 13:51:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 13F3120735 for ; Mon, 20 Apr 2020 13:51:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728392AbgDTNv1 (ORCPT ); Mon, 20 Apr 2020 09:51:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43356 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1726725AbgDTNv1 (ORCPT ); Mon, 20 Apr 2020 09:51:27 -0400 Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6D491C061A0C for ; Mon, 20 Apr 2020 06:51:27 -0700 (PDT) Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: scerveau) with ESMTPSA id 9EE042A0E54 From: =?utf-8?q?St=C3=A9phane_Cerveau?= To: linux-bluetooth@vger.kernel.org Cc: =?utf-8?q?St=C3=A9phane_Cerveau?= Subject: [PATCH 0/1] add hog ref in hog_attach_instance Date: Mon, 20 Apr 2020 15:51:11 +0200 Message-Id: <20200420135112.6749-1-scerveau@collabora.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Sender: linux-bluetooth-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-bluetooth@vger.kernel.org When I tried to connect a bluetooth gamepad 8718, I was experiencing a crash which can be reproduced always. https://www.amazon.com/Controller-PowerLead-Wireless-Compatible-Android/dp/B07XJ37HPK After investigation, it appears that instance was not reffed initially when added to the slist and double free was requested on this hog during the free of the slist (unref during a destroy_gatt_req). Stéphane Cerveau (1): add hog ref before adding to instances profiles/input/hog-lib.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)