[PATCH 2.6 IrDA] IrNET status event Oops

[Jean Tourrilhes <jt@bougret.hpl.hp.com>]

ir2609_irnet_ppp_open_race-2.diff :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	o [CRITICA] Prevent sending status event to dead/kfree sockets
	o [CORRECT] Disable PPP access before deregistration
		PPP deregistration might sleep -> race condition


diff -u -p linux/net/irda/irnet.d4/irnet_ppp.c linux/net/irda/irnet/irnet_ppp.c
--- linux/net/irda/irnet.d4/irnet_ppp.c	Sat Sep 27 17:50:38 2003
+++ linux/net/irda/irnet/irnet_ppp.c	Mon Oct 20 18:46:44 2003
@@ -512,8 +512,8 @@ dev_irnet_close(struct inode *	inode,
   if(ap->ppp_open)
     {
       DERROR(FS_ERROR, "Channel still registered - deregistering !\n");
-      ppp_unregister_channel(&ap->chan);
       ap->ppp_open = 0;
+      ppp_unregister_channel(&ap->chan);
     }
 
   kfree(ap);
@@ -651,10 +651,12 @@ dev_irnet_ioctl(struct inode *	inode,
 	  DEBUG(FS_INFO, "Exiting PPP discipline.\n");
 	  /* Disconnect from the generic PPP layer */
 	  if(ap->ppp_open)
-	    ppp_unregister_channel(&ap->chan);
+	    {
+	      ap->ppp_open = 0;
+	      ppp_unregister_channel(&ap->chan);
+	    }
 	  else
 	    DERROR(FS_ERROR, "Channel not registered !\n");
-	  ap->ppp_open = 0;
 	  err = 0;
 	}
       break;
diff -u -p linux/net/irda/irttp.d4.c linux/net/irda/irttp.c
--- linux/net/irda/irttp.d4.c	Tue Oct 21 10:36:40 2003
+++ linux/net/irda/irttp.c	Tue Oct 21 11:01:52 2003
@@ -968,6 +968,10 @@ void irttp_status_indication(void *insta
 	ASSERT(self != NULL, return;);
 	ASSERT(self->magic == TTP_TSAP_MAGIC, return;);
 
+	/* Check if client has already closed the TSAP and gone away */
+	if (self->close_pend)
+		return;
+
 	/*
 	 *  Inform service user if he has requested it
 	 */
@@ -1603,7 +1607,7 @@ void irttp_do_data_indication(struct tsa
 {
 	int err;
 
-	/* Check if client has already tried to close the TSAP */
+	/* Check if client has already closed the TSAP and gone away */
 	if (self->close_pend) {
 		dev_kfree_skb(skb);
 		return;