[IRDA]: Fix races between IRNET and PPP.

- Prevent sending status event to dead/kfree sockets
- Disable PPP access before deregistration
  PPP deregistration might sleep -> race condition

diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index b724fb087220f112e541e04bbd27fc3f23be21e5..98afb0a20ccd097884ecb81746fea73904b23de9 100644 (file)
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -512,8 +512,8 @@ dev_irnet_close(struct inode *      inode,
   if(ap->ppp_open)
     {
       DERROR(FS_ERROR, "Channel still registered - deregistering !\n");
-      ppp_unregister_channel(&ap->chan);
       ap->ppp_open = 0;
+      ppp_unregister_channel(&ap->chan);
     }
 
   kfree(ap);
@@ -651,10 +651,12 @@ dev_irnet_ioctl(struct inode *    inode,
          DEBUG(FS_INFO, "Exiting PPP discipline.\n");
          /* Disconnect from the generic PPP layer */
          if(ap->ppp_open)
-           ppp_unregister_channel(&ap->chan);
+           {
+             ap->ppp_open = 0;
+             ppp_unregister_channel(&ap->chan);
+           }
          else
            DERROR(FS_ERROR, "Channel not registered !\n");
-         ap->ppp_open = 0;
          err = 0;
        }
       break;

diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 3ba9512aa2207ae0f1099b5183ffd95fe4ea83c7..d41b81870da9626e4debe2910fffb74395e2dd06 100644 (file)
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -968,6 +968,10 @@ void irttp_status_indication(void *instance,
        ASSERT(self != NULL, return;);
        ASSERT(self->magic == TTP_TSAP_MAGIC, return;);
 
+       /* Check if client has already closed the TSAP and gone away */
+       if (self->close_pend)
+               return;
+
        /*
         *  Inform service user if he has requested it
         */
@@ -1603,7 +1607,7 @@ void irttp_do_data_indication(struct tsap_cb *self, struct sk_buff *skb)
 {
        int err;
 
-       /* Check if client has already tried to close the TSAP */
+       /* Check if client has already closed the TSAP and gone away */
        if (self->close_pend) {
                dev_kfree_skb(skb);
                return;