Re: [Bluez-devel] rfcomm oops in 2.5.74

[Dagfinn Ilmari Mannsåker]

Aurelien Minet <[e-mail]> writes:

Hi Aurelien, and thanks for the quick response.

>> Calling socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_RFCOMM) on 2.5.74
>> segfaults and gives the below oops. module.h:297 is
>> BUG_ON(module_refcount(module) == 0) in __module_get(), which is called
>> from rfcomm_sock_alloc() via sk_set_owner().
>
> I don't know for 2.5.xx  but for 2.4.xx in order to use RFCOMM protocol
> you must use a SOCK_STREAM and not SOCK_RAW socket type.
> (SOCK_RAW is for HCI , SOCK_SEQPACKET & SOCK_DGRAM for L2cap)
> I think it must return an error instead of making a segfault, in this
> way it is a bug.

I noticed it when rfcomm(1) segfaulted and caused the oops on startup,
so I straced it. The strace output is:

  [linking stuff snipped]
  socket(0x1f /* PF_??? */, SOCK_RAW, 3 <unfinished ...>
  +++ killed by SIGSEGV +++

According to <net/bluetooth/bluetooth.h> 0x1f is PF_BLUETOOTH and 3 is
PTPROTO_RFCOMM. Looking at the source, rfcomm(1) uses SOCK_RAW for the
RFCOMM control socket (for ioctls: RFCOMMGETDEVLIST, RFCOMMCREATEDEV,
RFCOMMRELEASEDEV, RFCOMMGETDEVINFO), and SOCK_STREAM for the data
sockets.

What is the correct way of doing these ioctls on 2.5 if not against a
SOCK_RAW socket?

-- 
ilmari