system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-22 03:55:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Bluetooth] Hangup TTY before releasing rfcomm_dev

Browse source 
The core problem is that RFCOMM socket layer ioctl can release
rfcomm_dev struct while RFCOMM TTY layer is still actively using
it. Calling tty_vhangup() is needed for a synchronous hangup before
rfcomm_dev is freed.

Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509

Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Mikko Rapeli 2007-07-11 09:18:15 +02:00 committed by Marcel Holtmann
parent 924f0e4a06
commit 84950cf0ba
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
net/bluetooth/rfcomm/tty.c
View file

@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg)
if (req.flags & (1 << RFCOMM_HANGUP_NOW))
rfcomm_dlc_close(dev->dlc, 0);
/* Shut down TTY synchronously before freeing rfcomm_dev */
if (dev->tty)
tty_vhangup(dev->tty);
rfcomm_dev_del(dev);
rfcomm_dev_put(dev);
return 0;