2 files changed, 37 insertions, 43 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 5759bb7054f..41b3a092841 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -62,7 +62,6 @@ static DEFINE_MUTEX(rfcomm_mutex);
 #define rfcomm_lock()   mutex_lock(&rfcomm_mutex)
 #define rfcomm_unlock() mutex_unlock(&rfcomm_mutex)
 
-static unsigned long rfcomm_event;
 
 static LIST_HEAD(session_list);
 
@@ -120,7 +119,6 @@ static inline void rfcomm_schedule(void)
 {
         if (!rfcomm_thread)
                 return;
-        set_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
         wake_up_process(rfcomm_thread);
 }
 
@@ -466,7 +464,6 @@ static int __rfcomm_dlc_close(struct rfcomm_dlc *d, int err)
 
         switch (d->state) {
         case BT_CONNECT:
-        case BT_CONFIG:
                 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
                         set_bit(RFCOMM_AUTH_REJECT, &d->flags);
                         rfcomm_schedule();
@@ -669,6 +666,9 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
 
         BT_DBG("session %p state %ld err %d", s, s->state, err);
 
+        if (s->state == BT_CLOSED)
+                return;
+
         rfcomm_session_hold(s);
 
         s->state = BT_CLOSED;
@@ -681,6 +681,12 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
         }
 
         rfcomm_session_clear_timer(s);
+
+        /* Drop reference for incoming sessions */
+        if (!s->initiator)
+                if (list_empty(&s->dlcs))
+                        rfcomm_session_put(s);
+
         rfcomm_session_put(s);
 }
 
@@ -1161,12 +1167,7 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         break;
 
                 case BT_DISCONN:
-                        /* When socket is closed and we are not RFCOMM
-                         * initiator rfcomm_process_rx already calls
-                         * rfcomm_session_put() */
-                        if (s->sock->sk->sk_state != BT_CLOSED)
-                                if (list_empty(&s->dlcs))
-                                        rfcomm_session_put(s);
+                        rfcomm_session_close(s, 0);
                         break;
                 }
         }
@@ -1197,7 +1198,6 @@ static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
                 else
                         err = ECONNRESET;
 
-                s->state = BT_CLOSED;
                 rfcomm_session_close(s, err);
         }
         return 0;
@@ -1232,7 +1232,6 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
                 else
                         err = ECONNRESET;
 
-                s->state = BT_CLOSED;
                 rfcomm_session_close(s, err);
         }
 
@@ -1858,12 +1857,8 @@ static inline void rfcomm_process_rx(struct rfcomm_session *s)
                 rfcomm_recv_frame(s, skb);
         }
 
-        if (sk->sk_state == BT_CLOSED) {
-                if (!s->initiator)
-                        rfcomm_session_put(s);
-
+        if (sk->sk_state == BT_CLOSED)
                 rfcomm_session_close(s, sk->sk_err);
-        }
 }
 
 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
@@ -1918,7 +1913,6 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
                 break;
 
         case BT_CLOSED:
-                s->state = BT_CLOSED;
                 rfcomm_session_close(s, sk->sk_err);
                 break;
         }
@@ -2038,19 +2032,18 @@ static int rfcomm_run(void *unused)
 
         rfcomm_add_listener(BDADDR_ANY);
 
-        while (!kthread_should_stop()) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!test_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event)) {
-                        /* No pending events. Let's sleep.
-                         * Incoming connections and data will wake us up. */
-                        schedule();
-                }
-                set_current_state(TASK_RUNNING);
+
+                if (kthread_should_stop())
+                        break;
 
                 /* Process stuff */
-                clear_bit(RFCOMM_SCHED_WAKEUP, &rfcomm_event);
                 rfcomm_process_sessions();
+
+                schedule();
         }
+        __set_current_state(TASK_RUNNING);
 
         rfcomm_kill_listener();
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 1b10727ce52..5417f612732 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -42,6 +42,7 @@
 #include <linux/device.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/security.h>
 #include <net/sock.h>
 
 #include <asm/system.h>
@@ -264,6 +265,8 @@ static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 
                 pi->sec_level = rfcomm_pi(parent)->sec_level;
                 pi->role_switch = rfcomm_pi(parent)->role_switch;
+
+                security_sk_clone(parent, sk);
         } else {
                 pi->dlc->defer_setup = 0;
 
@@ -485,11 +488,6 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 
         lock_sock(sk);
 
-        if (sk->sk_state != BT_LISTEN) {
-                err = -EBADFD;
-                goto done;
-        }
-
         if (sk->sk_type != SOCK_STREAM) {
                 err = -EINVAL;
                 goto done;
@@ -501,19 +499,20 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
 
         /* Wait for an incoming connection. (wake-one). */
         add_wait_queue_exclusive(sk_sleep(sk), &wait);
-        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
+        while (1) {
                 set_current_state(TASK_INTERRUPTIBLE);
-                if (!timeo) {
-                        err = -EAGAIN;
+
+                if (sk->sk_state != BT_LISTEN) {
+                        err = -EBADFD;
                         break;
                 }
 
-                release_sock(sk);
-                timeo = schedule_timeout(timeo);
-                lock_sock(sk);
+                nsk = bt_accept_dequeue(sk, newsock);
+                if (nsk)
+                        break;
 
-                if (sk->sk_state != BT_LISTEN) {
-                        err = -EBADFD;
+                if (!timeo) {
+                        err = -EAGAIN;
                         break;
                 }
 
@@ -521,8 +520,12 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                         err = sock_intr_errno(timeo);
                         break;
                 }
+
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
         }
-        set_current_state(TASK_RUNNING);
+        __set_current_state(TASK_RUNNING);
         remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
@@ -679,7 +682,8 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 {
         struct sock *sk = sock->sk;
         struct bt_security sec;
-        int len, err = 0;
+        int err = 0;
+        size_t len;
         u32 opt;
 
         BT_DBG("sk %p", sk);
@@ -741,7 +745,6 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 {
         struct sock *sk = sock->sk;
-        struct sock *l2cap_sk;
         struct rfcomm_conninfo cinfo;
         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
         int len, err = 0;
@@ -786,8 +789,6 @@ static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __u
                         break;
                 }
 
-                l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
-
                 memset(&cinfo, 0, sizeof(cinfo));
                 cinfo.hci_handle = conn->hcon->handle;
                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);