]> git.baikalelectronics.ru Git - kernel.git/commit
bluetooth: rfcomm_dev_state_change deadlock fix
authorDave Young <hidave.darkstar@gmail.com>
Mon, 2 Jun 2008 06:50:52 +0000 (23:50 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 3 Jun 2008 21:27:17 +0000 (14:27 -0700)
commit0ba339db8820a41952c3d65596963e2b23ec53e8
treebff5d6efbffbf6685cac5698efe7e3192e391047
parent133ec7b94a4402777370d0c53f7067395f8dddd1
bluetooth: rfcomm_dev_state_change deadlock fix

There's logic in __rfcomm_dlc_close:
rfcomm_dlc_lock(d);
d->state = BT_CLOSED;
d->state_changed(d, err);
rfcomm_dlc_unlock(d);

In rfcomm_dev_state_change, it's possible that rfcomm_dev_put try to
take the dlc lock, then we will deadlock.

Here fixed it by unlock dlc before rfcomm_dev_get in
rfcomm_dev_state_change.

why not unlock just before rfcomm_dev_put? it's because there's
another problem.  rfcomm_dev_get/rfcomm_dev_del will take
rfcomm_dev_lock, but in rfcomm_dev_add the lock order is :
rfcomm_dev_lock --> dlc lock

so I unlock dlc before the taken of rfcomm_dev_lock.

Actually it's a regression caused by commit
b98872e6ee39d019f3d72d13e74abb27d7a388cc ("bluetooth :
__rfcomm_dlc_close lock fix"), the dlc state_change could be two
callbacks : rfcomm_sk_state_change and rfcomm_dev_state_change. I
missed the rfcomm_sk_state_change that time.

Thanks Arjan van de Ven <arjan@linux.intel.com> for the effort in
commit 0a00a6170d95e5aa64c16f447f46c2396766c975 ("bluetooth: fix
locking bug in the rfcomm socket cleanup handling") but he missed the
rfcomm_dev_state_change lock issue.

Signed-off-by: Dave Young <hidave.darkstar@gmail.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/bluetooth/rfcomm/tty.c