Bluetooth: Fix RFCOMM tty teardown race
authorPeter Hurley <peter@hurleysoftware.com>
Mon, 10 Feb 2014 01:59:09 +0000 (20:59 -0500)
committerMarcel Holtmann <marcel@holtmann.org>
Fri, 14 Feb 2014 21:39:30 +0000 (13:39 -0800)
commitc949c224cfd7d5445ef947e8b93c0657323d5be5
tree99a229dec8e8b61a37ee0469aa45be3d38bfc397
parent80ea73378af46b0023eb2f400d26c2a60248ffaa
Bluetooth: Fix RFCOMM tty teardown race

RFCOMM tty device teardown can race with new tty device registration
for the same device id:

CPU 0                           | CPU 1
rfcomm_dev_add                  | rfcomm_dev_destruct
                                |   spin_lock
                                |   list_del   <== dev_id no longer used
                                |   spin_unlock
  spin_lock                     |     .
  [search rfcomm_dev_list]      |     .
  [dev_id not in use]           |     .
  [initialize new rfcomm_dev]   |     .
  spin_unlock                   |     .
                                |     .
  tty_port_register_device      |   tty_unregister_device

Don't remove rfcomm_dev from the device list until after tty device
unregistration has completed.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Tested-By: Alexander Holler <holler@ahsoftware.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/rfcomm/tty.c