Re: [PATCH] Race condition between RFCOMM and L2CAP

Hi,

On 09.11.2011 14:12, Kaczmarek Andrzej wrote:

Hi,

I recently came across race condition between RFCOMM and L2CAP.

When new rfcomm_session is allocated inside rfcomm_session_create there is also
L2CAP channel connection started there (and ACL link implicitly). And it can
happen that actions are scheduled in a way that rfcomm_security_cfm is called
before newly created rfcomm_session finished initialization and still has
refcnt set to 0 (because it's not yet linked to rfcomm_dlc). If this happens,
session will be deleted on rfcomm_session_put and connection will fail:

(...)

Any comments here? This does happen for me with some devices and it's 
quite easily reproducible.

BR,
Andrzej