Author: dannf Date: Wed Jul 18 08:35:40 2007 New Revision: 9168 Log: * [bluetooth] Fix panic caused by race between RFCOMM socket layer and RFCOMM TTY layer. Thanks to Mikko Rapeli. (closes: #394742)
Added: dists/etch/linux-2.6/debian/patches/bugfix/bluetooth-rfcomm-panic.patch dists/etch/linux-2.6/debian/patches/series/14 Modified: dists/etch/linux-2.6/debian/changelog Modified: dists/etch/linux-2.6/debian/changelog ============================================================================== --- dists/etch/linux-2.6/debian/changelog (original) +++ dists/etch/linux-2.6/debian/changelog Wed Jul 18 08:35:40 2007 @@ -1,8 +1,10 @@ linux-2.6 (2.6.18.dfsg.1-14) UNRELEASED; urgency=low * Update abi reference files for ABI 5 + * [bluetooth] Fix panic caused by race between RFCOMM socket layer and + RFCOMM TTY layer. Thanks to Mikko Rapeli. (closes: #394742) - -- dann frazier <[EMAIL PROTECTED]> Wed, 18 Jul 2007 02:28:15 -0600 + -- dann frazier <[EMAIL PROTECTED]> Wed, 18 Jul 2007 02:33:30 -0600 linux-2.6 (2.6.18.dfsg.1-13) stable; urgency=high Added: dists/etch/linux-2.6/debian/patches/bugfix/bluetooth-rfcomm-panic.patch ============================================================================== --- (empty file) +++ dists/etch/linux-2.6/debian/patches/bugfix/bluetooth-rfcomm-panic.patch Wed Jul 18 08:35:40 2007 @@ -0,0 +1,33 @@ +From: Mikko Rapeli <[EMAIL PROTECTED]> +Date: Wed, 11 Jul 2007 07:18:15 +0000 (+0200) +Subject: [Bluetooth] Hangup TTY before releasing rfcomm_dev +X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fholtmann%2Fbluetooth-2.6.git;a=commitdiff_plain;h=84950cf0ba02fd6a5defe2511bc41f9aa2237632 + +[Bluetooth] Hangup TTY before releasing rfcomm_dev + +The core problem is that RFCOMM socket layer ioctl can release +rfcomm_dev struct while RFCOMM TTY layer is still actively using +it. Calling tty_vhangup() is needed for a synchronous hangup before +rfcomm_dev is freed. + +Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509 + +Acked-by: Alan Cox <[EMAIL PROTECTED]> +Signed-off-by: Marcel Holtmann <[EMAIL PROTECTED]> +--- + +diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c +index b2b1cce..ba469b0 100644 +--- a/net/bluetooth/rfcomm/tty.c ++++ b/net/bluetooth/rfcomm/tty.c +@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg) + if (req.flags & (1 << RFCOMM_HANGUP_NOW)) + rfcomm_dlc_close(dev->dlc, 0); + ++ /* Shut down TTY synchronously before freeing rfcomm_dev */ ++ if (dev->tty) ++ tty_vhangup(dev->tty); ++ + rfcomm_dev_del(dev); + rfcomm_dev_put(dev); + return 0; Added: dists/etch/linux-2.6/debian/patches/series/14 ============================================================================== --- (empty file) +++ dists/etch/linux-2.6/debian/patches/series/14 Wed Jul 18 08:35:40 2007 @@ -0,0 +1 @@ ++ bugfix/bluetooth-rfcomm-panic.patch _______________________________________________ Kernel-svn-changes mailing list [email protected] http://lists.alioth.debian.org/mailman/listinfo/kernel-svn-changes
