summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMikko Rapeli <mikko.rapeli@iki.fi>2007-07-11 09:18:15 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2007-08-09 14:27:46 -0700
commit772aa8b19ac7c8965ea896c3f8ea0bec8f6b6ee7 (patch)
treeb7db03c7989c2a9fa6afb0a0455b8f22ab0d0be7
parent2547c387c41e5dda43f7a484a46b40ae0b491aef (diff)
downloadlwn-772aa8b19ac7c8965ea896c3f8ea0bec8f6b6ee7.tar.gz
lwn-772aa8b19ac7c8965ea896c3f8ea0bec8f6b6ee7.zip
Hangup TTY before releasing rfcomm_dev
The core problem is that RFCOMM socket layer ioctl can release rfcomm_dev struct while RFCOMM TTY layer is still actively using it. Calling tty_vhangup() is needed for a synchronous hangup before rfcomm_dev is freed. Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509 Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--net/bluetooth/rfcomm/tty.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b2b1cceb102a..ba469b038ea0 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg)
if (req.flags & (1 << RFCOMM_HANGUP_NOW))
rfcomm_dlc_close(dev->dlc, 0);
+ /* Shut down TTY synchronously before freeing rfcomm_dev */
+ if (dev->tty)
+ tty_vhangup(dev->tty);
+
rfcomm_dev_del(dev);
rfcomm_dev_put(dev);
return 0;