The patch titled
rfcomm: hangup ttys before releasing rfcomm_dev
has been added to the -mm tree. Its filename is
rfcomm-hangup-ttys-before-releasing-rfcomm_dev.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: rfcomm: hangup ttys before releasing rfcomm_dev
Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509
The core problem is that rfcomm socket layer ioctl can release rfcomm_dev
struct while rfcomm tty layer is still actively using it. Calling tty_vhangup
is needed for a synchronous hangup before rfcomm_dev is freed.
Cc: Marcel Holtmann <marcel@xxxxxxxxxxxx>
Cc: Alan Cox <alan@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
net/bluetooth/rfcomm/tty.c | 6 ++++++
1 files changed, 6 insertions(+)
diff -puN net/bluetooth/rfcomm/tty.c~rfcomm-hangup-ttys-before-releasing-rfcomm_dev net/bluetooth/rfcomm/tty.c
--- a/net/bluetooth/rfcomm/tty.c~rfcomm-hangup-ttys-before-releasing-rfcomm_dev
+++ a/net/bluetooth/rfcomm/tty.c
@@ -383,6 +383,12 @@ static int rfcomm_release_dev(void __use
if (req.flags & (1 << RFCOMM_HANGUP_NOW))
rfcomm_dlc_close(dev->dlc, 0);
+ /*
+ * Be nice and shut down tty(s) synchronously before freeing rfcomm_dev
+ */
+ if (dev->tty)
+ tty_vhangup(dev->tty);
+
rfcomm_dev_del(dev);
rfcomm_dev_put(dev);
return 0;
_
Patches currently in -mm which might be from marcel@xxxxxxxxxxxx are
bluetooth-remove-the-redundant-non-seekable-llseek-method.patch
rfcomm-hangup-ttys-before-releasing-rfcomm_dev.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
