summaryrefslogtreecommitdiffstats
path: root/net/ax25
diff options
context:
space:
mode:
authorDave Young <hidave.darkstar@gmail.com>2008-06-01 23:50:52 -0700
committerDavid S. Miller <davem@davemloft.net>2008-06-03 14:27:17 -0700
commit537d59af73d894750cff14f90fe2b6d77fbab15b (patch)
treebff5d6efbffbf6685cac5698efe7e3192e391047 /net/ax25
parentc3b25b32e8bef526cca748e1ba023c6bdd705a99 (diff)
downloadblackbird-op-linux-537d59af73d894750cff14f90fe2b6d77fbab15b.tar.gz
blackbird-op-linux-537d59af73d894750cff14f90fe2b6d77fbab15b.zip
bluetooth: rfcomm_dev_state_change deadlock fix
There's logic in __rfcomm_dlc_close: rfcomm_dlc_lock(d); d->state = BT_CLOSED; d->state_changed(d, err); rfcomm_dlc_unlock(d); In rfcomm_dev_state_change, it's possible that rfcomm_dev_put try to take the dlc lock, then we will deadlock. Here fixed it by unlock dlc before rfcomm_dev_get in rfcomm_dev_state_change. why not unlock just before rfcomm_dev_put? it's because there's another problem. rfcomm_dev_get/rfcomm_dev_del will take rfcomm_dev_lock, but in rfcomm_dev_add the lock order is : rfcomm_dev_lock --> dlc lock so I unlock dlc before the taken of rfcomm_dev_lock. Actually it's a regression caused by commit 1905f6c736cb618e07eca0c96e60e3c024023428 ("bluetooth : __rfcomm_dlc_close lock fix"), the dlc state_change could be two callbacks : rfcomm_sk_state_change and rfcomm_dev_state_change. I missed the rfcomm_sk_state_change that time. Thanks Arjan van de Ven <arjan@linux.intel.com> for the effort in commit 4c8411f8c115def968820a4df6658ccfd55d7f1a ("bluetooth: fix locking bug in the rfcomm socket cleanup handling") but he missed the rfcomm_dev_state_change lock issue. Signed-off-by: Dave Young <hidave.darkstar@gmail.com> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ax25')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud