Commit 6d53d31c authored by Dann Frazier's avatar Dann Frazier

* [bluetooth] Fix panic caused by race between RFCOMM socket layer and

  RFCOMM TTY layer. Thanks to Mikko Rapeli. (closes: #394742)

svn path=/dists/etch/linux-2.6/; revision=9168
parent 2a63c658
linux-2.6 (2.6.18.dfsg.1-14) UNRELEASED; urgency=low
* Update abi reference files for ABI 5
* [bluetooth] Fix panic caused by race between RFCOMM socket layer and
RFCOMM TTY layer. Thanks to Mikko Rapeli. (closes: #394742)
-- dann frazier <dannf@debian.org> Wed, 18 Jul 2007 02:28:15 -0600
-- dann frazier <dannf@debian.org> Wed, 18 Jul 2007 02:33:30 -0600
linux-2.6 (2.6.18.dfsg.1-13) stable; urgency=high
......
From: Mikko Rapeli <mikko.rapeli@iki.fi>
Date: Wed, 11 Jul 2007 07:18:15 +0000 (+0200)
Subject: [Bluetooth] Hangup TTY before releasing rfcomm_dev
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fholtmann%2Fbluetooth-2.6.git;a=commitdiff_plain;h=84950cf0ba02fd6a5defe2511bc41f9aa2237632
[Bluetooth] Hangup TTY before releasing rfcomm_dev
The core problem is that RFCOMM socket layer ioctl can release
rfcomm_dev struct while RFCOMM TTY layer is still actively using
it. Calling tty_vhangup() is needed for a synchronous hangup before
rfcomm_dev is freed.
Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b2b1cce..ba469b0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg)
if (req.flags & (1 << RFCOMM_HANGUP_NOW))
rfcomm_dlc_close(dev->dlc, 0);
+ /* Shut down TTY synchronously before freeing rfcomm_dev */
+ if (dev->tty)
+ tty_vhangup(dev->tty);
+
rfcomm_dev_del(dev);
rfcomm_dev_put(dev);
return 0;
+ bugfix/bluetooth-rfcomm-panic.patch
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment