⬢ DragonFlyBSD Kernel Audit
DF-5752 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
--- a/sys/netbt/hci_unit.c	2026-10-11 08:02:59.057438200 +0000
+++ b/sys/netbt/hci_unit.c	2026-10-11 08:18:17.853550900 +0000
@@ -434,7 +434,7 @@
 	} else {
 		unit->hci_eventqlen++;
 		IF_ENQUEUE(&unit->hci_eventq, m);
-		netisr_queue(NETISR_BLUETOOTH, m);
+		schednetisr(NETISR_BLUETOOTH);
 		rv = 1;
 	}
 	lockmgr(&unit->hci_devlock, LK_RELEASE);
@@ -456,7 +456,7 @@
 	} else {
 		unit->hci_aclrxqlen++;
 		IF_ENQUEUE(&unit->hci_aclrxq, m);
-		netisr_queue(NETISR_BLUETOOTH, m);
+		schednetisr(NETISR_BLUETOOTH);
 		rv = 1;
 	}
 	lockmgr(&unit->hci_devlock, LK_RELEASE);
@@ -478,7 +478,7 @@
 	} else {
 		unit->hci_scorxqlen++;
 		IF_ENQUEUE(&unit->hci_scorxq, m);
-		netisr_queue(NETISR_BLUETOOTH, m);
+		schednetisr(NETISR_BLUETOOTH);
 		rv = 1;
 	}
 	lockmgr(&unit->hci_devlock, LK_RELEASE);
@@ -540,7 +540,7 @@
 {
 	lockmgr(&unit->hci_devlock, LK_EXCLUSIVE);
 	IF_ENQUEUE(&unit->hci_scodone, m);
-	netisr_queue(NETISR_BLUETOOTH,m);
+	schednetisr(NETISR_BLUETOOTH);
 	lockmgr(&unit->hci_devlock, LK_RELEASE);
 
 	return 1;
--- a/sys/netbt/bt_input.c	2026-10-11 08:02:59.061438148 +0000
+++ b/sys/netbt/bt_input.c	2026-10-11 08:18:17.853550900 +0000
@@ -25,6 +25,7 @@
 #include <net/netisr.h>
 
 #include <sys/mplock2.h>
+#include <sys/msgport2.h>
 
 #include <netbt/hci.h>
 
@@ -33,6 +34,14 @@
 {
 	struct hci_unit *unit;
 
+	/*
+	 * After the netisr_queue() -> schednetisr() change no packets are
+	 * ever sent to this netisr: every invocation is a kick of the
+	 * fixed ni_netmsg, which must be replied so later kicks work
+	 * (same contract as ngintr()).
+	 */
+	lwkt_replymsg(&msg->lmsg, 0);
+
 	get_mplock();
 	TAILQ_FOREACH(unit, &hci_unit_list, hci_next) {
 		hci_intr(unit);