[kernel] r9168 - in dists/etch/linux-2.6/debian: . patches/bugfix patches/series
Dann Frazier
dannf at alioth.debian.org
Wed Jul 18 08:35:41 UTC 2007
Author: dannf
Date: Wed Jul 18 08:35:40 2007
New Revision: 9168
Log:
* [bluetooth] Fix panic caused by race between RFCOMM socket layer and
RFCOMM TTY layer. Thanks to Mikko Rapeli. (closes: #394742)
Added:
dists/etch/linux-2.6/debian/patches/bugfix/bluetooth-rfcomm-panic.patch
dists/etch/linux-2.6/debian/patches/series/14
Modified:
dists/etch/linux-2.6/debian/changelog
Modified: dists/etch/linux-2.6/debian/changelog
==============================================================================
--- dists/etch/linux-2.6/debian/changelog (original)
+++ dists/etch/linux-2.6/debian/changelog Wed Jul 18 08:35:40 2007
@@ -1,8 +1,10 @@
linux-2.6 (2.6.18.dfsg.1-14) UNRELEASED; urgency=low
* Update abi reference files for ABI 5
+ * [bluetooth] Fix panic caused by race between RFCOMM socket layer and
+ RFCOMM TTY layer. Thanks to Mikko Rapeli. (closes: #394742)
- -- dann frazier <dannf at debian.org> Wed, 18 Jul 2007 02:28:15 -0600
+ -- dann frazier <dannf at debian.org> Wed, 18 Jul 2007 02:33:30 -0600
linux-2.6 (2.6.18.dfsg.1-13) stable; urgency=high
Added: dists/etch/linux-2.6/debian/patches/bugfix/bluetooth-rfcomm-panic.patch
==============================================================================
--- (empty file)
+++ dists/etch/linux-2.6/debian/patches/bugfix/bluetooth-rfcomm-panic.patch Wed Jul 18 08:35:40 2007
@@ -0,0 +1,33 @@
+From: Mikko Rapeli <mikko.rapeli at iki.fi>
+Date: Wed, 11 Jul 2007 07:18:15 +0000 (+0200)
+Subject: [Bluetooth] Hangup TTY before releasing rfcomm_dev
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fholtmann%2Fbluetooth-2.6.git;a=commitdiff_plain;h=84950cf0ba02fd6a5defe2511bc41f9aa2237632
+
+[Bluetooth] Hangup TTY before releasing rfcomm_dev
+
+The core problem is that RFCOMM socket layer ioctl can release
+rfcomm_dev struct while RFCOMM TTY layer is still actively using
+it. Calling tty_vhangup() is needed for a synchronous hangup before
+rfcomm_dev is freed.
+
+Addresses the oops at http://bugzilla.kernel.org/show_bug.cgi?id=7509
+
+Acked-by: Alan Cox <alan at lxorguk.ukuu.org.uk>
+Signed-off-by: Marcel Holtmann <marcel at holtmann.org>
+---
+
+diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
+index b2b1cce..ba469b0 100644
+--- a/net/bluetooth/rfcomm/tty.c
++++ b/net/bluetooth/rfcomm/tty.c
+@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg)
+ if (req.flags & (1 << RFCOMM_HANGUP_NOW))
+ rfcomm_dlc_close(dev->dlc, 0);
+
++ /* Shut down TTY synchronously before freeing rfcomm_dev */
++ if (dev->tty)
++ tty_vhangup(dev->tty);
++
+ rfcomm_dev_del(dev);
+ rfcomm_dev_put(dev);
+ return 0;
Added: dists/etch/linux-2.6/debian/patches/series/14
==============================================================================
--- (empty file)
+++ dists/etch/linux-2.6/debian/patches/series/14 Wed Jul 18 08:35:40 2007
@@ -0,0 +1 @@
++ bugfix/bluetooth-rfcomm-panic.patch
More information about the Kernel-svn-changes
mailing list