[PATCH] Revert "Keep rfcomm_dev on the list until it is freed"

Randy Dunlap and Boris B. Zhmurov reported build failure of
rfcomm/tty.c since 2.6.20.17. Marcel Holtmann confirmed that
the following patch was inappropriate for this kernel. Remove
it.

This reverts commit 8c25e9c9cd1fed0d5f57075b584c39a4b9af9830.

Cc: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/include/net/bluetooth/rfcomm.h b/include/net/bluetooth/rfcomm.h
index 25aa575db807b8e7881aec4bcafa428e24dbb779..3c563f02907cc5228b21aac7967f874039047f4c 100644 (file)
--- a/include/net/bluetooth/rfcomm.h
+++ b/include/net/bluetooth/rfcomm.h
@@ -323,7 +323,6 @@ int  rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc
 #define RFCOMM_RELEASE_ONHUP  1
 #define RFCOMM_HANGUP_NOW     2
 #define RFCOMM_TTY_ATTACHED   3
-#define RFCOMM_TTY_RELEASED   4
 
 struct rfcomm_dev_req {
        s16      dev_id;

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 26e8c022ad934d8193b8e7aeeb1b6aca2c5e40da..e1b866323d43cf210cd2ac44fe9c0617ab5ae86d 100644 (file)
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -93,10 +93,6 @@ static void rfcomm_dev_destruct(struct rfcomm_dev *dev)
 
        BT_DBG("dev %p dlc %p", dev, dlc);
 
-       write_lock_bh(&rfcomm_dev_lock);
-       list_del_init(&dev->list);
-       write_unlock_bh(&rfcomm_dev_lock);
-
        rfcomm_dlc_lock(dlc);
        /* Detach DLC if it's owned by this dev */
        if (dlc->owner == dev)
@@ -158,13 +154,8 @@ static inline struct rfcomm_dev *rfcomm_dev_get(int id)
        read_lock(&rfcomm_dev_lock);
 
        dev = __rfcomm_dev_get(id);
-
-       if (dev) {
-               if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
-                       dev = NULL;
-               else
-                       rfcomm_dev_hold(dev);
-       }
+       if (dev)
+               rfcomm_dev_hold(dev);
 
        read_unlock(&rfcomm_dev_lock);
 
@@ -272,12 +263,6 @@ out:
 
        tty_register_device(rfcomm_tty_driver, dev->id, rfcomm_get_device(dev));
 
-       if (IS_ERR(dev->tty_dev)) {
-               list_del(&dev->list);
-               kfree(dev);
-               return PTR_ERR(dev->tty_dev);
-       }
-
        return dev->id;
 }
 
@@ -285,7 +270,10 @@ static void rfcomm_dev_del(struct rfcomm_dev *dev)
 {
        BT_DBG("dev %p", dev);
 
-       set_bit(RFCOMM_TTY_RELEASED, &dev->flags);
+       write_lock_bh(&rfcomm_dev_lock);
+       list_del_init(&dev->list);
+       write_unlock_bh(&rfcomm_dev_lock);
+
        rfcomm_dev_put(dev);
 }
 
@@ -339,7 +327,7 @@ static int rfcomm_create_dev(struct sock *sk, void __user *arg)
        if (copy_from_user(&req, arg, sizeof(req)))
                return -EFAULT;
 
-       BT_DBG("sk %p dev_id %d flags 0x%x", sk, req.dev_id, req.flags);
+       BT_DBG("sk %p dev_id %id flags 0x%x", sk, req.dev_id, req.flags);
 
        if (req.flags != NOCAP_FLAGS && !capable(CAP_NET_ADMIN))
                return -EPERM;
@@ -380,7 +368,7 @@ static int rfcomm_release_dev(void __user *arg)
        if (copy_from_user(&req, arg, sizeof(req)))
                return -EFAULT;
 
-       BT_DBG("dev_id %d flags 0x%x", req.dev_id, req.flags);
+       BT_DBG("dev_id %id flags 0x%x", req.dev_id, req.flags);
 
        if (!(dev = rfcomm_dev_get(req.dev_id)))
                return -ENODEV;
@@ -429,8 +417,6 @@ static int rfcomm_get_dev_list(void __user *arg)
 
        list_for_each(p, &rfcomm_dev_list) {
                struct rfcomm_dev *dev = list_entry(p, struct rfcomm_dev, list);
-               if (test_bit(RFCOMM_TTY_RELEASED, &dev->flags))
-                       continue;
                (di + n)->id      = dev->id;
                (di + n)->flags   = dev->flags;
                (di + n)->state   = dev->dlc->state;