lkml.org 
[lkml]   [2007]   [Nov]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
SubjectRe: [PATCH]bluetooth rfcomm_dev refcount bug fix
From
Date
Hi Dave,

> In the rfcomm_tty_hangup the rfcomm_dev refcnt should be dropped later.
>
> If rfcomm_dev is destructed in tty_hangup function, then the later tty_close function will oops.

your patch removes the complete release on hangup logic. That can't be
right. I think the problem is with calling tty_vhangup() and then
decrementing the reference count. In case we call tty_vhangup and we
have release on hangup we should not delete the device here. What about
the attached patch? Does it solve it?

What are the steps to reproduce this?

Regards

Marcel

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e447651..b405b9a 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -425,8 +425,11 @@ static int rfcomm_release_dev(void __user *arg)
if (dev->tty)
tty_vhangup(dev->tty);

- rfcomm_dev_del(dev);
- rfcomm_dev_put(dev);
+ if (!test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
+ rfcomm_dev_del(dev);
+ rfcomm_dev_put(dev);
+ }
+
return 0;
}
\
 
 \ /
  Last update: 2007-11-05 16:03    [W:0.047 / U:0.176 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site