diff options
| author | Mikko Rapeli <mikko.rapeli@iki.fi> | 2007-07-11 09:18:15 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2007-07-11 07:01:26 +0200 |
| commit | 84950cf0ba02fd6a5defe2511bc41f9aa2237632 (patch) | |
| tree | e6c6d6b243d8c8d5bafdaa9d2054458409b17c82 /net/bluetooth | |
| parent | 924f0e4a06419fa1996425d1d2512030e43acbba (diff) | |
| download | lwn-84950cf0ba02fd6a5defe2511bc41f9aa2237632.tar.gz lwn-84950cf0ba02fd6a5defe2511bc41f9aa2237632.zip | |
[Bluetooth] Hangup TTY before releasing rfcomm_dev
The core problem is that RFCOMM socket layer ioctl can release
rfcomm_dev struct while RFCOMM TTY layer is still actively using
it. Calling tty_vhangup() is needed for a synchronous hangup before
rfcomm_dev is freed.
Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/rfcomm/tty.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c index b2b1cceb102a..ba469b038ea0 100644 --- a/net/bluetooth/rfcomm/tty.c +++ b/net/bluetooth/rfcomm/tty.c @@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg) if (req.flags & (1 << RFCOMM_HANGUP_NOW)) rfcomm_dlc_close(dev->dlc, 0); + /* Shut down TTY synchronously before freeing rfcomm_dev */ + if (dev->tty) + tty_vhangup(dev->tty); + rfcomm_dev_del(dev); rfcomm_dev_put(dev); return 0; |