diff options
author | Dave Young <hidave.darkstar@gmail.com> | 2008-06-01 23:50:52 -0700 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2008-06-03 14:27:17 -0700 |
commit | 537d59af73d894750cff14f90fe2b6d77fbab15b (patch) | |
tree | bff5d6efbffbf6685cac5698efe7e3192e391047 /net/ax25 | |
parent | c3b25b32e8bef526cca748e1ba023c6bdd705a99 (diff) | |
download | kernel_samsung_smdk4412-537d59af73d894750cff14f90fe2b6d77fbab15b.zip kernel_samsung_smdk4412-537d59af73d894750cff14f90fe2b6d77fbab15b.tar.gz kernel_samsung_smdk4412-537d59af73d894750cff14f90fe2b6d77fbab15b.tar.bz2 |
bluetooth: rfcomm_dev_state_change deadlock fix
There's logic in __rfcomm_dlc_close:
rfcomm_dlc_lock(d);
d->state = BT_CLOSED;
d->state_changed(d, err);
rfcomm_dlc_unlock(d);
In rfcomm_dev_state_change, it's possible that rfcomm_dev_put try to
take the dlc lock, then we will deadlock.
Here fixed it by unlock dlc before rfcomm_dev_get in
rfcomm_dev_state_change.
why not unlock just before rfcomm_dev_put? it's because there's
another problem. rfcomm_dev_get/rfcomm_dev_del will take
rfcomm_dev_lock, but in rfcomm_dev_add the lock order is :
rfcomm_dev_lock --> dlc lock
so I unlock dlc before the taken of rfcomm_dev_lock.
Actually it's a regression caused by commit
1905f6c736cb618e07eca0c96e60e3c024023428 ("bluetooth :
__rfcomm_dlc_close lock fix"), the dlc state_change could be two
callbacks : rfcomm_sk_state_change and rfcomm_dev_state_change. I
missed the rfcomm_sk_state_change that time.
Thanks Arjan van de Ven <arjan@linux.intel.com> for the effort in
commit 4c8411f8c115def968820a4df6658ccfd55d7f1a ("bluetooth: fix
locking bug in the rfcomm socket cleanup handling") but he missed the
rfcomm_dev_state_change lock issue.
Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ax25')
0 files changed, 0 insertions, 0 deletions