Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=77f2a45fa1ba33147fd6cc8ae546188504a822cd
Commit:     77f2a45fa1ba33147fd6cc8ae546188504a822cd
Parent:     48db9ca4f2ac9f39eb90ccb12ad3ca7b645a552c
Author:     Marcel Holtmann <[EMAIL PROTECTED]>
AuthorDate: Sat May 5 00:36:10 2007 +0200
Committer:  Marcel Holtmann <[EMAIL PROTECTED]>
CommitDate: Sat May 5 00:36:10 2007 +0200

    [Bluetooth] Check that device is in rfcomm_dev_list before deleting
    
    If RFCOMM_RELEASE_ONHUP flag is on and rfcomm_release_dev is called
    before connection is closed, rfcomm_dev is deleted twice from the
    rfcomm_dev_list and refcount is messed up. This patch adds a check
    before deleting device that the device actually is listed.
    
    Signed-off-by: Ville Tervo <[EMAIL PROTECTED]>
    Signed-off-by: Marcel Holtmann <[EMAIL PROTECTED]>
---
 net/bluetooth/rfcomm/tty.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 9a7a44f..b2b1cce 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -517,9 +517,10 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc 
*dlc, int err)
        if (dlc->state == BT_CLOSED) {
                if (!dev->tty) {
                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                               rfcomm_dev_hold(dev);
-                               rfcomm_dev_del(dev);
+                               if (rfcomm_dev_get(dev->id) == NULL)
+                                       return;
 
+                               rfcomm_dev_del(dev);
                                /* We have to drop DLC lock here, otherwise
                                   rfcomm_dev_put() will dead lock if it's
                                   the last reference. */
@@ -974,8 +975,12 @@ static void rfcomm_tty_hangup(struct tty_struct *tty)
 
        rfcomm_tty_flush_buffer(tty);
 
-       if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
+       if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
+               if (rfcomm_dev_get(dev->id) == NULL)
+                       return;
                rfcomm_dev_del(dev);
+               rfcomm_dev_put(dev);
+       }
 }
 
 static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int 
len, int *eof, void *unused)
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to