projects
/
firefly-linux-kernel-4.4.55.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Bluetooth: Fix RFCOMM tty teardown race
[firefly-linux-kernel-4.4.55.git]
/
net
/
bluetooth
/
rfcomm
/
tty.c
diff --git
a/net/bluetooth/rfcomm/tty.c
b/net/bluetooth/rfcomm/tty.c
index bb570d95adca2d589cf9f1560b2cfa5685f3d9c0..6ea08b05b53a0ed19db047cc69c780aca7c05389 100644
(file)
--- a/
net/bluetooth/rfcomm/tty.c
+++ b/
net/bluetooth/rfcomm/tty.c
@@
-84,10
+84,6
@@
static void rfcomm_dev_destruct(struct tty_port *port)
BT_DBG("dev %p dlc %p", dev, dlc);
BT_DBG("dev %p dlc %p", dev, dlc);
- spin_lock(&rfcomm_dev_lock);
- list_del(&dev->list);
- spin_unlock(&rfcomm_dev_lock);
-
rfcomm_dlc_lock(dlc);
/* Detach DLC if it's owned by this dev */
if (dlc->owner == dev)
rfcomm_dlc_lock(dlc);
/* Detach DLC if it's owned by this dev */
if (dlc->owner == dev)
@@
-98,6
+94,10
@@
static void rfcomm_dev_destruct(struct tty_port *port)
tty_unregister_device(rfcomm_tty_driver, dev->id);
tty_unregister_device(rfcomm_tty_driver, dev->id);
+ spin_lock(&rfcomm_dev_lock);
+ list_del(&dev->list);
+ spin_unlock(&rfcomm_dev_lock);
+
kfree(dev);
/* It's safe to call module_put() here because socket still
kfree(dev);
/* It's safe to call module_put() here because socket still