[Bluez-devel] Re: rfcomm oops

[Marcel Holtmann <marcel@holtmann.org>]

[-- Attachment #1: Type: text/plain, Size: 419 bytes --]

Hi Ville,

> I found reproducible way to make rfcomm layer oops. I attached oops and
> some notes how they were produced. I used several Nokia phones and IBM
> T40 laptop in these tests.

if the attached patch makes it go away, then I know what it is. Actually
I introduced that problem when I tried to fix another bug with buggy
phones that can't disconnect their DLCI 0 even if they established it.

Regards

Marcel


[-- Attachment #2: patch --]
[-- Type: text/x-patch, Size: 484 bytes --]

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -389,8 +389,6 @@ static int __rfcomm_dlc_close(struct rfc
 		rfcomm_dlc_unlock(d);
 
 		skb_queue_purge(&d->tx_queue);
-		rfcomm_session_put(s);
-
 		rfcomm_dlc_unlink(d);
 	}
 
@@ -600,8 +598,6 @@ static struct rfcomm_session *rfcomm_ses
 		goto failed;
 	}
 
-	rfcomm_session_hold(s);
-
 	s->initiator = 1;
 
 	bacpy(&addr.l2_bdaddr, dst);