diff options
| author | Lan Zhu <zhu.lan.cn@gmail.com> | 2009-09-16 18:07:25 -0700 |
|---|---|---|
| committer | Nick Pelly <npelly@google.com> | 2009-09-16 18:12:11 -0700 |
| commit | 6f505dbe5337e49302574f8d2e65fd83e30f9117 (patch) | |
| tree | 63d1e94b0f840dc18a46c00170bcffd968368cca /net | |
| parent | 63b9fe6c840c8a2fd9230f6db5f9533d4232771f (diff) | |
Bluetooth: Fix kernel panic while disconnecting RFCOMM
rfcomm_session_del() was being called after session entry removed from list.
Signed-off-by: Nick Pelly <npelly@google.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/rfcomm/core.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c index c109a3a225c6..5d66c1f3abf5 100644 --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -1795,6 +1795,8 @@ static inline void rfcomm_process_rx(struct rfcomm_session *s) BT_DBG("session %p state %ld qlen %d", s, s->state, skb_queue_len(&sk->sk_receive_queue)); + rfcomm_session_hold(s); + /* Get data directly from socket receive queue without copying it. */ while ((skb = skb_dequeue(&sk->sk_receive_queue))) { skb_orphan(skb); @@ -1807,6 +1809,8 @@ static inline void rfcomm_process_rx(struct rfcomm_session *s) rfcomm_session_close(s, sk->sk_err); } + + rfcomm_session_put(s); } static inline void rfcomm_accept_connection(struct rfcomm_session *s) |