Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/torvalds/linux-2.6

[linux-2.6] / net / bluetooth / rfcomm / tty.c

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index e4c779bb8d76e6cf9dfab3b82a3ae33f7276dc68..be84f4fc1477fc7ae8790fe99cdb75128a01b1d2 100644 (file)
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -23,8 +23,6 @@
 
 /*
  * RFCOMM TTY.
- *
- * $Id: tty.c,v 1.24 2002/10/03 01:54:38 holtmann Exp $
  */
 
 #include <linux/module.h>
@@ -566,14 +564,20 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
        if (dlc->state == BT_CLOSED) {
                if (!dev->tty) {
                        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                               if (rfcomm_dev_get(dev->id) == NULL)
+                               /* Drop DLC lock here to avoid deadlock
+                                * 1. rfcomm_dev_get will take rfcomm_dev_lock
+                                *    but in rfcomm_dev_add there's lock order:
+                                *    rfcomm_dev_lock -> dlc lock
+                                * 2. rfcomm_dev_put will deadlock if it's
+                                *    the last reference
+                                */
+                               rfcomm_dlc_unlock(dlc);
+                               if (rfcomm_dev_get(dev->id) == NULL) {
+                                       rfcomm_dlc_lock(dlc);
                                        return;
+                               }
 
                                rfcomm_dev_del(dev);
-                               /* We have to drop DLC lock here, otherwise
-                                  rfcomm_dev_put() will dead lock if it's
-                                  the last reference. */
-                               rfcomm_dlc_unlock(dlc);
                                rfcomm_dev_put(dev);
                                rfcomm_dlc_lock(dlc);
                        }