Commit 84950cf0 authored Jul 11, 2007 by Mikko Rapeli Committed by Marcel Holtmann Jul 11, 2007

[Bluetooth] Hangup TTY before releasing rfcomm_dev

The core problem is that RFCOMM socket layer ioctl can release
rfcomm_dev struct while RFCOMM TTY layer is still actively using
it. Calling tty_vhangup() is needed for a synchronous hangup before
rfcomm_dev is freed.

Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509



Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

parent 924f0e4a

net/bluetooth/rfcomm/tty.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg)
		if (req.flags & (1 << RFCOMM_HANGUP_NOW))
		rfcomm_dlc_close(dev->dlc, 0);

		/* Shut down TTY synchronously before freeing rfcomm_dev */
		if (dev->tty)
		tty_vhangup(dev->tty);

		rfcomm_dev_del(dev);
		rfcomm_dev_put(dev);
		return 0;