Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: rfkill: add support for input key to control wireless radio
  [NET] net/core: Fix error handling
  [TG3]: Update version and reldate.
  [TG3]: Eliminate spurious interrupts.
  [TG3]: Add ASPM workaround.
  [Bluetooth] Correct SCO buffer for another Broadcom based dongle
  [Bluetooth] Add support for Targus ACB10US USB dongle
  [Bluetooth] Disconnect L2CAP connection after last RFCOMM DLC
  [Bluetooth] Check that device is in rfcomm_dev_list before deleting
  [Bluetooth] Use in-kernel sockets API
  [Bluetooth] Attach host adapters to the Bluetooth bus
  [Bluetooth] Fix L2CAP and HCI setsockopt() information leaks

2 files changed, 24 insertions, 16 deletions

diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index fe7df90eb707..52e04df323ea 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -622,7 +622,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         bacpy(&addr.l2_bdaddr, src);
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = 0;
-        *err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
+        *err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (*err < 0)
                 goto failed;
 
@@ -643,7 +643,7 @@ static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src, bdaddr_t *dst
         bacpy(&addr.l2_bdaddr, dst);
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = htobs(RFCOMM_PSM);
-        *err = sock->ops->connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
+        *err = kernel_connect(sock, (struct sockaddr *) &addr, sizeof(addr), O_NONBLOCK);
         if (*err == 0 || *err == -EINPROGRESS)
                 return s;
 
@@ -1058,6 +1058,12 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                 case BT_DISCONN:
                         d->state = BT_CLOSED;
                         __rfcomm_dlc_close(d, 0);
+
+                        if (list_empty(&s->dlcs)) {
+                                s->state = BT_DISCONN;
+                                rfcomm_send_disc(s, 0);
+                        }
+
                         break;
                 }
         } else {
@@ -1067,6 +1073,10 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                         s->state = BT_CONNECTED;
                         rfcomm_process_connect(s);
                         break;
+
+                case BT_DISCONN:
+                        rfcomm_session_put(s);
+                        break;
                 }
         }
         return 0;
@@ -1757,19 +1767,12 @@ static inline void rfcomm_accept_connection(struct rfcomm_session *s)
 
         BT_DBG("session %p", s);
 
-        if (sock_create_lite(PF_BLUETOOTH, sock->type, BTPROTO_L2CAP, &nsock))
+        err = kernel_accept(sock, &nsock, O_NONBLOCK);
+        if (err < 0)
                 return;
 
-        nsock->ops  = sock->ops;
-
         __module_get(nsock->ops->owner);
 
-        err = sock->ops->accept(sock, nsock, O_NONBLOCK);
-        if (err < 0) {
-                sock_release(nsock);
-                return;
-        }
-
         /* Set our callbacks */
         nsock->sk->sk_data_ready   = rfcomm_l2data_ready;
         nsock->sk->sk_state_change = rfcomm_l2state_change;
@@ -1885,7 +1888,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         bacpy(&addr.l2_bdaddr, ba);
         addr.l2_family = AF_BLUETOOTH;
         addr.l2_psm    = htobs(RFCOMM_PSM);
-        err = sock->ops->bind(sock, (struct sockaddr *) &addr, sizeof(addr));
+        err = kernel_bind(sock, (struct sockaddr *) &addr, sizeof(addr));
         if (err < 0) {
                 BT_ERR("Bind failed %d", err);
                 goto failed;
@@ -1898,7 +1901,7 @@ static int rfcomm_add_listener(bdaddr_t *ba)
         release_sock(sk);
 
         /* Start listening on the socket */
-        err = sock->ops->listen(sock, 10);
+        err = kernel_listen(sock, 10);
         if (err) {
                 BT_ERR("Listen failed %d", err);
                 goto failed;
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 9a7a44fc721f..b2b1cceb102a 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -517,9 +517,10 @@ static void rfcomm_dev_state_change(struct rfcomm_dlc *dlc, int err)
         if (dlc->state == BT_CLOSED) {
                 if (!dev->tty) {
                         if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
-                                rfcomm_dev_hold(dev);
-                                rfcomm_dev_del(dev);
+                                if (rfcomm_dev_get(dev->id) == NULL)
+                                        return;
 
+                                rfcomm_dev_del(dev);
                                 /* We have to drop DLC lock here, otherwise
                                    rfcomm_dev_put() will dead lock if it's
                                    the last reference. */
@@ -974,8 +975,12 @@ static void rfcomm_tty_hangup(struct tty_struct *tty)
 
         rfcomm_tty_flush_buffer(tty);
 
-        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))
+        if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags)) {
+                if (rfcomm_dev_get(dev->id) == NULL)
+                        return;
                 rfcomm_dev_del(dev);
+                rfcomm_dev_put(dev);
+        }
 }
 
 static int rfcomm_tty_read_proc(char *buf, char **start, off_t offset, int len, int *eof, void *unused)