diff -u -p linux/include/net/irda/irmod.d2.h linux/include/net/irda/irmod.h
--- linux/include/net/irda/irmod.d2.h   Wed Nov  7 13:21:31 2001
+++ linux/include/net/irda/irmod.h      Wed Nov  7 13:57:41 2001
@@ -10,6 +10,7 @@
  * Modified by:   Dag Brattli <dagb@cs.uit.no>
  *
  *     Copyright (c) 1998-2000 Dag Brattli, All Rights Reserved.
+ *     Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com>
  *      
  *     This program is free software; you can redistribute it and/or 
  *     modify it under the terms of the GNU General Public License as 
@@ -25,108 +26,19 @@
 #ifndef IRMOD_H
 #define IRMOD_H
 
-#include <linux/skbuff.h>
-#include <linux/miscdevice.h>
+#include <net/irda/irda.h>             /* Notify stuff */
 
-#include <net/irda/irqueue.h>
+/* Nothing much here anymore - Maybe this header should be merged in
+ * another header like net/irda/irda.h... - Jean II */
 
-#define IRMGR_IOC_MAGIC 'm'
-#define IRMGR_IOCTNPC     _IO(IRMGR_IOC_MAGIC, 1)
-#define IRMGR_IOC_MAXNR   1 
-
-/*
- *  Events that we pass to the user space manager
- */
-typedef enum {
-       EVENT_DEVICE_DISCOVERED = 0,
-       EVENT_REQUEST_MODULE,
-       EVENT_IRLAN_START,
-       EVENT_IRLAN_STOP,
-       EVENT_IRLPT_START,  /* Obsolete */
-       EVENT_IRLPT_STOP,   /* Obsolete */
-       EVENT_IROBEX_START, /* Obsolete */
-       EVENT_IROBEX_STOP,  /* Obsolete */
-       EVENT_IRDA_STOP,
-       EVENT_NEED_PROCESS_CONTEXT,
-} IRMGR_EVENT;
-
-/*
- *  Event information passed to the IrManager daemon process
- */
-struct irmanager_event {
-       IRMGR_EVENT event;
-       char devname[10];
-       char info[32];
-       int service;
-       __u32 saddr;
-       __u32 daddr;
-};
-
-typedef void (*TODO_CALLBACK)( void *self, __u32 param);
-
-/*
- *  Same as irmanager_event but this one can be queued and inclueds some
- *  addtional information
- */
-struct irda_event {
-       irda_queue_t q; /* Must be first */
-       
-       struct irmanager_event event;
-};
-
-/*
- *  Funtions with needs to be called with a process context
- */
-struct irda_todo {
-       irda_queue_t q; /* Must be first */
-
-       void *self;
-       TODO_CALLBACK callback;
-       __u32 param;
-};
-
-/*
- *  Main structure for the IrDA device (not much here :-)
- */
-struct irda_cb {
-       struct miscdevice dev;  
-       wait_queue_head_t wait_queue;
-
-       int in_use;
-
-       irda_queue_t *event_queue; /* Events queued for the irmanager */
-       irda_queue_t *todo_queue;  /* Todo list */
-};
-
-int irmod_init_module(void);
-void irmod_cleanup_module(void);
-
-/*
- * Function irda_lock (lock)
- *
- *    Lock variable. Returns false if the lock is already set.
- *    
- */
-static inline int irda_lock(int *lock) 
-{
-       if (test_and_set_bit( 0, (void *) lock))  {
-               IRDA_DEBUG(3, __FUNCTION__ 
-                     "(), Trying to lock, already locked variable!\n");
-               return FALSE;
-        }  
-       return TRUE;
-}
-
-inline int irda_unlock(int *lock);
+/* Locking wrapper - Note the inverted logic on irda_lock().
+ * Those function basically return false if the lock is already in the
+ * position you want to set it. - Jean II */
+#define irda_lock(lock)                (! test_and_set_bit(0, (void *) (lock)))
+#define irda_unlock(lock)      (test_and_clear_bit(0, (void *) (lock)))
 
+/* Zero the notify structure */
 void irda_notify_init(notify_t *notify);
-
-void irda_execute_as_process(void *self, TODO_CALLBACK callback, __u32 param);
-void irmanager_notify(struct irmanager_event *event);
-
-extern void irda_proc_modcount(struct inode *, int);
-void irda_mod_inc_use_count(void);
-void irda_mod_dec_use_count(void);
 
 #endif /* IRMOD_H */
 
diff -u -p linux/net/irda/irsyms.d2.c linux/net/irda/irsyms.c
--- linux/net/irda/irsyms.d2.c  Wed Nov  7 13:16:00 2001
+++ linux/net/irda/irsyms.c     Wed Nov  7 13:42:19 2001
@@ -10,6 +10,7 @@
  * Modified by:   Dag Brattli <dagb@cs.uit.no>
  * 
  *     Copyright (c) 1997, 1999-2000 Dag Brattli, All Rights Reserved.
+ *     Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com>
  *      
  *     This program is free software; you can redistribute it and/or 
  *     modify it under the terms of the GNU General Public License as 
@@ -79,7 +80,6 @@ EXPORT_SYMBOL(irttp_dup);
 EXPORT_SYMBOL(irda_debug);
 #endif
 EXPORT_SYMBOL(irda_notify_init);
-EXPORT_SYMBOL(irda_lock);
 #ifdef CONFIG_PROC_FS
 EXPORT_SYMBOL(proc_irda);
 #endif
@@ -217,21 +217,6 @@ static void __exit irda_cleanup(void)
 
        /* Remove middle layer */
        irlmp_cleanup();
-}
-
-/*
- * Function irda_unlock (lock)
- *
- *    Unlock variable. Returns false if lock is already unlocked
- *
- */
-inline int irda_unlock(int *lock) 
-{
-       if (!test_and_clear_bit(0, (void *) lock))  {
-               printk("Trying to unlock already unlocked variable!\n");
-               return FALSE;
-        }
-       return TRUE;
 }
 
 /*
diff -u -p linux/net/irda/irttp.d2.c linux/net/irda/irttp.c
--- linux/net/irda/irttp.d2.c   Tue Oct 30 18:14:58 2001
+++ linux/net/irda/irttp.c      Wed Nov  7 13:33:09 2001
@@ -11,6 +11,7 @@
  * 
  *     Copyright (c) 1998-2000 Dag Brattli <dagb@cs.uit.no>, 
  *     All Rights Reserved.
+ *     Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com>
  *     
  *     This program is free software; you can redistribute it and/or 
  *     modify it under the terms of the GNU General Public License as 
@@ -223,6 +224,11 @@ static void __irttp_close_tsap(struct ts
 
        del_timer(&self->todo_timer);
 
+       /* This one won't be cleaned up if we are diconnect_pend + close_pend
+        * and we receive a disconnect_indication */
+       if (self->disconnect_skb)
+               dev_kfree_skb(self->disconnect_skb);
+
        self->connected = FALSE;
        self->magic = ~TTP_TSAP_MAGIC;
 
@@ -235,6 +241,9 @@ static void __irttp_close_tsap(struct ts
  *    Remove TSAP from list of all TSAPs and then deallocate all resources
  *    associated with this TSAP
  *
+ * Note : because we *free* the tsap structure, it is the responsability
+ * of the caller to make sure we are called only once and to deal with
+ * possible race conditions. - Jean II
  */
 int irttp_close_tsap(struct tsap_cb *self)
 {
@@ -248,8 +257,8 @@ int irttp_close_tsap(struct tsap_cb *sel
        /* Make sure tsap has been disconnected */
        if (self->connected) {
                /* Check if disconnect is not pending */
-               if (!self->disconnect_pend) {
-                       IRDA_DEBUG(0, __FUNCTION__ "(), TSAP still connected!\n");
+               if (!test_bit(0, &self->disconnect_pend)) {
+                       WARNING(__FUNCTION__ "(), TSAP still connected!\n");
                        irttp_disconnect_request(self, NULL, P_NORMAL);
                }
                self->close_pend = TRUE;
@@ -407,6 +416,7 @@ static void irttp_run_tx_queue(struct ts
        unsigned long flags;
        int n;
 
+       /* Get exclusive access to the tx queue, otherwise don't touch it */
        if (irda_lock(&self->tx_queue_lock) == FALSE)
                return;
 
@@ -473,27 +483,17 @@ static void irttp_run_tx_queue(struct ts
                 * close the socket, we are dead !
                 * Jean II */
                if (skb->sk != NULL) {
-                       struct sk_buff *tx_skb;
-
                        /* IrSOCK application, IrOBEX, ... */
                        IRDA_DEBUG(4, __FUNCTION__ "() : Detaching SKB from socket.\n");
-                       /* Note : still looking for a more efficient way
-                        * to do that - Jean II */
 
-                       /* Get another skb on the same buffer, but without
-                        * a reference to the socket (skb->sk = NULL) */
-                       tx_skb = skb_clone(skb, GFP_ATOMIC);
-                       if (tx_skb != NULL) {
-                               /* Release the skb associated with the
-                                * socket, and use the new skb insted */
-                               kfree_skb(skb);
-                               skb = tx_skb;
-                       }
+                       /* That's the right way to do it - Jean II */
+                       skb_orphan(skb);
                } else {
                        /* IrCOMM over IrTTP, IrLAN, ... */
                        IRDA_DEBUG(4, __FUNCTION__ "() : Got SKB not attached to a socket.\n");
                }
 
+               /* Pass the skb to IrLMP - done */
                irlmp_data_request(self->lsap, skb);
                self->stats.tx_packets++;
 
@@ -1105,18 +1105,23 @@ int irttp_disconnect_request(struct tsap
        /* Already disconnected? */
        if (!self->connected) {
                IRDA_DEBUG(4, __FUNCTION__ "(), already disconnected!\n");
+               if (userdata)
+                       dev_kfree_skb(userdata);
                return -1;
        }
 
-       /* Disconnect already pending? */
-       if (self->disconnect_pend) {
-               IRDA_DEBUG(1, __FUNCTION__ "(), disconnect already pending\n");
-               if (userdata) {
+       /* Disconnect already pending ?
+        * We need to use an atomic operation to prevent reentry. This
+        * function may be called from various context, like user, timer
+        * for following a disconnect_indication() (i.e. net_bh).
+        * Jean II */
+       if(test_and_set_bit(0, &self->disconnect_pend)) {
+               IRDA_DEBUG(0, __FUNCTION__ "(), disconnect already pending\n");
+               if (userdata)
                        dev_kfree_skb(userdata);
-               }
 
                /* Try to make some progress */
-               irttp_run_rx_queue(self);
+               irttp_run_tx_queue(self);
                return -1;
        }
 
@@ -1125,25 +1130,20 @@ int irttp_disconnect_request(struct tsap
         */
        if (skb_queue_len(&self->tx_queue) > 0) {
                if (priority == P_HIGH) {
-                       IRDA_DEBUG(1, __FUNCTION__  "High priority!!()\n" );
-                       
                        /* 
                         *  No need to send the queued data, if we are 
                         *  disconnecting right now since the data will
                         *  not have any usable connection to be sent on
                         */
+                       IRDA_DEBUG(1, __FUNCTION__  "High priority!!()\n" );
                        irttp_flush_queues(self);
                } else if (priority == P_NORMAL) {
                        /* 
-                        *  Must delay disconnect til after all data segments
-                        *  have been sent an the tx_queue is empty
+                        *  Must delay disconnect until after all data segments
+                        *  have been sent and the tx_queue is empty
                         */
-                       if (userdata)
-                               self->disconnect_skb = userdata;
-                       else
-                               self->disconnect_skb = NULL;
-
-                       self->disconnect_pend = TRUE;
+                       /* We'll reuse this one later for the disconnect */
+                       self->disconnect_skb = userdata;  /* May be NULL */
 
                        irttp_run_tx_queue(self);
 
@@ -1152,9 +1152,8 @@ int irttp_disconnect_request(struct tsap
                }
        }
        IRDA_DEBUG(1, __FUNCTION__ "(), Disconnecting ...\n");
-
        self->connected = FALSE;
-       
+
        if (!userdata) {
                skb = dev_alloc_skb(64);
                if (!skb)
@@ -1169,6 +1168,9 @@ int irttp_disconnect_request(struct tsap
        }
        ret = irlmp_disconnect_request(self->lsap, userdata);
 
+       /* The disconnect is no longer pending */
+       clear_bit(0, &self->disconnect_pend);   /* FALSE */
+
        return ret;
 }
 
@@ -1190,19 +1192,27 @@ void irttp_disconnect_indication(void *i
        ASSERT(self != NULL, return;);
        ASSERT(self->magic == TTP_TSAP_MAGIC, return;);
        
+       /* Prevent higher layer to send more data */
        self->connected = FALSE;
        
        /* Check if client has already tried to close the TSAP */
        if (self->close_pend) {
+               /* In this case, the higher layer is probably gone. Don't
+                * bother it and clean up the remains - Jean II */
+               if (skb)
+                       dev_kfree_skb(skb);
                irttp_close_tsap(self);
                return;
        }
 
+       /* If we are here, we assume that is the higher layer is still
+        * waiting for the disconnect notification and able to process it,
+        * even if he tried to disconnect. Otherwise, it would have already
+        * attempted to close the tsap and self->close_pend would be TRUE.
+        * Jean II */
+
        /* No need to notify the client if has already tried to disconnect */
-       if (self->disconnect_pend)
-               return;
-       
-       if (self->notify.disconnect_indication)
+       if(self->notify.disconnect_indication)
                self->notify.disconnect_indication(self->notify.instance, self,
                                                   reason, skb);
        else
@@ -1222,7 +1232,7 @@ void irttp_do_data_indication(struct tsa
        int err;
 
        /* Check if client has already tried to close the TSAP */
-       if (self->close_pend || self->disconnect_pend) {
+       if (self->close_pend) {
                dev_kfree_skb(skb);
                return;
        }
@@ -1263,6 +1273,7 @@ void irttp_run_rx_queue(struct tsap_cb *
        IRDA_DEBUG(2, __FUNCTION__ "() send=%d,avail=%d,remote=%d\n", 
                   self->send_credit, self->avail_credit, self->remote_credit);
 
+       /* Get exclusive access to the rx queue, otherwise don't touch it */
        if (irda_lock(&self->rx_queue_lock) == FALSE)
                return;
        
@@ -1500,7 +1511,7 @@ static int irttp_param_max_sdu_size(void
        else
                self->tx_max_sdu_size = param->pv.i;
 
-       IRDA_DEBUG(0, __FUNCTION__ "(), MaxSduSize=%d\n", param->pv.i);
+       IRDA_DEBUG(1, __FUNCTION__ "(), MaxSduSize=%d\n", param->pv.i);
        
        return 0;
 }
@@ -1530,18 +1541,16 @@ static void irttp_todo_expired(unsigned 
        }
 
        /* Check if time for disconnect */
-       if (self->disconnect_pend) {
+       if (test_bit(0, &self->disconnect_pend)) {
                /* Check if it's possible to disconnect yet */
                if (skb_queue_empty(&self->tx_queue)) {
-                       
                        /* Make sure disconnect is not pending anymore */
-                       self->disconnect_pend = FALSE;
-                       if (self->disconnect_skb) {
-                               irttp_disconnect_request(
-                                       self, self->disconnect_skb, P_NORMAL);
-                               self->disconnect_skb = NULL;
-                       } else
-                               irttp_disconnect_request(self, NULL, P_NORMAL);
+                       clear_bit(0, &self->disconnect_pend);   /* FALSE */
+
+                       /* Note : self->disconnect_skb may be NULL */
+                       irttp_disconnect_request(self, self->disconnect_skb,
+                                                P_NORMAL);
+                       self->disconnect_skb = NULL;
                } else {
                        /* Try again later */
                        irttp_start_todo_timer(self, 1*HZ);
diff -u -p linux/net/irda/af_irda.d2.c linux/net/irda/af_irda.c
--- linux/net/irda/af_irda.d2.c Fri Nov  2 11:09:12 2001
+++ linux/net/irda/af_irda.c    Mon Nov  5 18:40:11 2001
@@ -11,7 +11,7 @@
  * Sources:       af_netroom.c, af_ax25.c, af_rose.c, af_x25.c etc.
  * 
  *     Copyright (c) 1999 Dag Brattli <dagb@cs.uit.no>
- *     Copyright (c) 1999 Jean Tourrilhes <jt@hpl.hp.com>
+ *     Copyright (c) 1999-2001 Jean Tourrilhes <jt@hpl.hp.com>
  *     All Rights Reserved.
  *
  *     This program is free software; you can redistribute it and/or 
@@ -134,33 +134,41 @@ static void irda_disconnect_indication(v
 
        IRDA_DEBUG(2, __FUNCTION__ "(%p)\n", self);
 
+       /* Don't care about it, but let's not leak it */
+       if(skb)
+               dev_kfree_skb(skb);
+
        sk = self->sk;
        if (sk == NULL)
                return;
 
-       sk->state     = TCP_CLOSE;
-        sk->err       = ECONNRESET;
-        sk->shutdown |= SEND_SHUTDOWN;
-       if (!sk->dead) {
+       /* Prevent race conditions with irda_release() and irda_shutdown() */
+       if ((!sk->dead) && (sk->state != TCP_CLOSE)) {
+               sk->state     = TCP_CLOSE;
+               sk->err       = ECONNRESET;
+               sk->shutdown |= SEND_SHUTDOWN;
+
                sk->state_change(sk);
-                sk->dead = 1;
-        }
+                sk->dead = 1;  /* Uh-oh... Should use sock_orphan ? */
 
-       /* Close our TSAP.
-        * If we leave it open, IrLMP put it back into the list of
-        * unconnected LSAPs. The problem is that any incoming request
-        * can then be matched to this socket (and it will be, because
-        * it is at the head of the list). This would prevent any
-        * listening socket waiting on the same TSAP to get those requests.
-        * Some apps forget to close sockets, or hang to it a bit too long,
-        * so we may stay in this dead state long enough to be noticed...
-        * Note : all socket function do check sk->state, so we are safe...
-        * Jean II
-        */
-       if (self->tsap) {
-               irttp_close_tsap(self->tsap);
-               self->tsap = NULL;
-       }
+               /* Close our TSAP.
+                * If we leave it open, IrLMP put it back into the list of
+                * unconnected LSAPs. The problem is that any incoming request
+                * can then be matched to this socket (and it will be, because
+                * it is at the head of the list). This would prevent any
+                * listening socket waiting on the same TSAP to get those
+                * requests. Some apps forget to close sockets, or hang to it
+                * a bit too long, so we may stay in this dead state long
+                * enough to be noticed...
+                * Note : all socket function do check sk->state, so we are
+                * safe...
+                * Jean II
+                */
+               if (self->tsap) {
+                       irttp_close_tsap(self->tsap);
+                       self->tsap = NULL;
+               }
+        }
 
        /* Note : once we are there, there is not much you want to do
         * with the socket anymore, apart from closing it.
@@ -222,7 +230,8 @@ static void irda_connect_confirm(void *i
                   self->max_data_size);
 
        memcpy(&self->qos_tx, qos, sizeof(struct qos_info));
-       kfree_skb(skb);
+       dev_kfree_skb(skb);
+       // Should be ??? skb_queue_tail(&sk->receive_queue, skb);
 
        /* We are now connected! */
        sk->state = TCP_ESTABLISHED;
@@ -1205,7 +1214,7 @@ static int irda_release(struct socket *s
        sk->protinfo.irda = NULL;
 
        sock_orphan(sk);
-        sock->sk   = NULL;      
+       sock->sk   = NULL;      
 
        /* Purge queues (see sock_init_data()) */
        skb_queue_purge(&sk->receive_queue);
diff -u -p linux/net/irda/iriap.d2.c linux/net/irda/iriap.c
--- linux/net/irda/iriap.d2.c   Fri Nov  2 11:14:13 2001
+++ linux/net/irda/iriap.c      Mon Nov  5 18:41:12 2001
@@ -11,6 +11,7 @@
  * 
  *     Copyright (c) 1998-1999 Dag Brattli <dagb@cs.uit.no>, 
  *     All Rights Reserved.
+ *     Copyright (c) 2000-2001 Jean Tourrilhes <jt@hpl.hp.com>
  *     
  *     This program is free software; you can redistribute it and/or 
  *     modify it under the terms of the GNU General Public License as 
@@ -773,7 +774,7 @@ static void iriap_connect_indication(voi
 {
        struct iriap_cb *self, *new;
 
-       IRDA_DEBUG(0, __FUNCTION__ "()\n");
+       IRDA_DEBUG(1, __FUNCTION__ "()\n");
 
        self = (struct iriap_cb *) instance;
 
diff -u -p linux/net/irda/irnet/irnet.d2.h linux/net/irda/irnet/irnet.h
--- linux/net/irda/irnet/irnet.d2.h     Wed Oct 31 16:09:19 2001
+++ linux/net/irda/irnet/irnet.h        Wed Nov  7 14:02:34 2001
@@ -126,17 +126,17 @@
  * History :
  * -------
  *
- * v1 - 15/5/00 - Jean II
+ * v1 - 15.5.00 - Jean II
  *     o Basic IrNET (hook to ppp_generic & IrTTP - incl. multipoint)
  *     o control channel on /dev/irnet (set name/address)
  *     o event channel on /dev/irnet (for user space daemon)
  *
- * v2 - 5/6/00 - Jean II
+ * v2 - 5.6.00 - Jean II
  *     o Enable DROP_NOT_READY to avoid PPP timeouts & other weirdness...
  *     o Add DISCONNECT_TO event and rename DISCONNECT_FROM.
  *     o Set official device number alloaction on /dev/irnet
  *
- * v3 - 30/8/00 - Jean II
+ * v3 - 30.8.00 - Jean II
  *     o Update to latest Linux-IrDA changes :
  *             - queue_t => irda_queue_t
  *     o Update to ppp-2.4.0 :
@@ -148,17 +148,17 @@
  *       another multilink bug (darn !)
  *     o Remove LINKNAME_IOCTL cruft
  *
- * v3b - 31/8/00 - Jean II
+ * v3b - 31.8.00 - Jean II
  *     o Dump discovery log at event channel startup
  *
- * v4 - 28/9/00 - Jean II
+ * v4 - 28.9.00 - Jean II
  *     o Fix interaction between poll/select and dump discovery log
  *     o Add IRNET_BLOCKED_LINK event (depend on new IrDA-Linux patch)
  *     o Add IRNET_NOANSWER_FROM event (mostly to help support)
  *     o Release flow control in disconnect_indication
  *     o Block packets while connecting (speed up connections)
  *
- * v5 - 11/01/01 - Jean II
+ * v5 - 11.01.01 - Jean II
  *     o Init self->max_header_size, just in case...
  *     o Set up ap->chan.hdrlen, to get zero copy on tx side working.
  *     o avoid tx->ttp->flow->ppp->tx->... loop, by checking flow state
@@ -169,7 +169,7 @@
  *     o Declare hashbin HB_NOLOCK instead of HB_LOCAL to avoid
  *             disabling and enabling irq twice
  *
- * v6 - 31/05/01 - Jean II
+ * v6 - 31.05.01 - Jean II
  *     o Print source address in Found, Discovery, Expiry & Request events
  *     o Print requested source address in /proc/net/irnet
  *     o Change control channel input. Allow multiple commands in one line.
@@ -186,12 +186,19 @@
  *     o Add ttp_connect flag to prevent rentry on the connect procedure
  *     o Test and fixups to eliminate side effects of retries
  *
- * v7 - 22/08/01 - Jean II
+ * v7 - 22.08.01 - Jean II
  *     o Cleanup : Change "saddr = 0x0" to "saddr = DEV_ADDR_ANY"
  *     o Fix bug in BLOCK_WHEN_CONNECT introduced in v6 : due to the
  *       asynchronous IAS query, self->tsap is NULL when PPP send the
  *       first packet.  This was preventing "connect-delay 0" to work.
  *       Change the test in ppp_irnet_send() to self->ttp_connect.
+ *
+ * v8 - 1.11.01 - Jean II
+ *     o Tighten the use of self->ttp_connect and self->ttp_open to
+ *       prevent various race conditions.
+ *     o Avoid leaking discovery log and skb
+ *     o Replace "self" with "server" in irnet_connect_indication() to
+ *       better detect cut'n'paste error ;-)
  */
 
 /***************************** INCLUDES *****************************/
@@ -204,6 +211,7 @@
 #include <linux/proc_fs.h>
 #include <linux/devfs_fs_kernel.h>
 #include <linux/netdevice.h>
+#include <linux/miscdevice.h>
 #include <linux/poll.h>
 #include <linux/config.h>
 #include <linux/ctype.h>       /* isspace() */
diff -u -p linux/net/irda/irnet/irnet_irda.d2.c linux/net/irda/irnet/irnet_irda.c
--- linux/net/irda/irnet/irnet_irda.d2.c        Wed Oct 31 16:00:53 2001
+++ linux/net/irda/irnet/irnet_irda.c   Wed Nov  7 10:48:58 2001
@@ -272,7 +272,7 @@ irnet_connect_tsap(irnet_socket *     self)
   err = irnet_open_tsap(self);
   if(err != 0)
     {
-      self->ttp_connect = 0;
+      clear_bit(0, &self->ttp_connect);
       DERROR(IRDA_SR_ERROR, "connect aborted!\n");
       return(err);
     }
@@ -283,7 +283,7 @@ irnet_connect_tsap(irnet_socket *     self)
                              self->max_sdu_size_rx, NULL);
   if(err != 0)
     {
-      self->ttp_connect = 0;
+      clear_bit(0, &self->ttp_connect);
       DERROR(IRDA_SR_ERROR, "connect aborted!\n");
       return(err);
     }
@@ -377,7 +377,7 @@ irnet_discover_daddr_and_lsap_sel(irnet_
   if(self->discoveries == NULL)
     {
       self->disco_number = -1;
-      self->ttp_connect = 0;
+      clear_bit(0, &self->ttp_connect);
       DRETURN(-ENETUNREACH, IRDA_SR_INFO, "No Cachelog...\n");
     }
   DEBUG(IRDA_SR_INFO, "Got the log (0x%X), size is %d\n",
@@ -399,7 +399,7 @@ irnet_discover_daddr_and_lsap_sel(irnet_
       kfree(self->discoveries);
       self->discoveries = NULL;
 
-      self->ttp_connect = 0;
+      clear_bit(0, &self->ttp_connect);
       DRETURN(-ENETUNREACH, IRDA_SR_INFO, "Cachelog empty...\n");
     }
 
@@ -518,12 +518,12 @@ irda_irnet_connect(irnet_socket *   self)
 
   DENTER(IRDA_SOCK_TRACE, "(self=0x%X)\n", (unsigned int) self);
 
-  /* Check if we have opened a local TSAP :
-   * If we have already opened a TSAP, it means that either we are already
-   * connected or in the process of doing so... */
-  if(self->ttp_connect)
+  /* Check if we are already trying to connect.
+   * Because irda_irnet_connect() can be called directly by pppd plus
+   * packet retries in ppp_generic and connect may take time, plus we may
+   * race with irnet_connect_indication(), we need to be careful there... */
+  if(test_and_set_bit(0, &self->ttp_connect))
     DRETURN(-EBUSY, IRDA_SOCK_INFO, "Already connecting...\n");
-  self->ttp_connect = 1;
   if((self->iriap != NULL) || (self->tsap != NULL))
     DERROR(IRDA_SOCK_ERROR, "Socket not cleaned up...\n");
 
@@ -579,6 +579,7 @@ irda_irnet_connect(irnet_socket *     self)
  *
  *    Destroy irnet instance
  *
+ * Note : this need to be called from a process context.
  */
 void
 irda_irnet_destroy(irnet_socket *      self)
@@ -601,6 +602,23 @@ irda_irnet_destroy(irnet_socket *    self)
       DASSERT(entry == self, , IRDA_SOCK_ERROR, "Can't remove from hash.\n");
     }
 
+  /* If we were connected, post a message */
+  if(test_bit(0, &self->ttp_open))
+    {
+      /* Note : as the disconnect comes from ppp_generic, the unit number
+       * doesn't exist anymore when we post the event, so we need to pass
+       * NULL as the first arg... */
+      irnet_post_event(NULL, IRNET_DISCONNECT_TO,
+                      self->saddr, self->daddr, self->rname);
+    }
+
+  /* Prevent various IrDA callbacks from messing up things
+   * Need to be first */
+  clear_bit(0, &self->ttp_connect);
+
+  /* Prevent higher layer from accessing IrTTP */
+  clear_bit(0, &self->ttp_open);
+
   /* Unregister with IrLMP */
   irlmp_unregister_client(self->ckey);
 
@@ -611,19 +629,14 @@ irda_irnet_destroy(irnet_socket *   self)
       self->iriap = NULL;
     }
 
-  /* If we were connected, post a message */
-  if(self->ttp_open)
+  /* Cleanup eventual discoveries from connection attempt */
+  if(self->discoveries != NULL)
     {
-      /* Note : as the disconnect comes from ppp_generic, the unit number
-       * doesn't exist anymore when we post the event, so we need to pass
-       * NULL as the first arg... */
-      irnet_post_event(NULL, IRNET_DISCONNECT_TO,
-                      self->saddr, self->daddr, self->rname);
+      /* Cleanup our copy of the discovery log */
+      kfree(self->discoveries);
+      self->discoveries = NULL;
     }
 
-  /* Prevent higher layer from accessing IrTTP */
-  self->ttp_open = 0;
-
   /* Close our IrTTP connection */
   if(self->tsap)
     {
@@ -761,7 +774,7 @@ irnet_find_socket(irnet_socket *      self)
       while(new !=(irnet_socket *) NULL)
        {
          /* Is it available ? */
-         if(!(new->ttp_open) && (new->rdaddr == DEV_ADDR_ANY) &&
+         if(!(test_bit(0, &new->ttp_open)) && (new->rdaddr == DEV_ADDR_ANY) &&
             (new->rname[0] == '\0') && (new->ppp_open))
            {
              /* Yes !!! Get it.. */
@@ -788,17 +801,17 @@ irnet_find_socket(irnet_socket *    self)
  *
  */
 static inline int
-irnet_connect_socket(irnet_socket *    self,
+irnet_connect_socket(irnet_socket *    server,
                     irnet_socket *     new,
                     struct qos_info *  qos,
                     __u32              max_sdu_size,
                     __u8               max_header_size)
 {
-  DENTER(IRDA_SERV_TRACE, "(self=0x%X, new=0x%X)\n",
-        (unsigned int) self, (unsigned int) new);
+  DENTER(IRDA_SERV_TRACE, "(server=0x%X, new=0x%X)\n",
+        (unsigned int) server, (unsigned int) new);
 
   /* Now attach up the new socket */
-  new->tsap = irttp_dup(self->tsap, new);
+  new->tsap = irttp_dup(server->tsap, new);
   DABORT(new->tsap == NULL, -1, IRDA_SERV_ERROR, "dup failed!\n");
 
   /* Set up all the relevant parameters on the new socket */
@@ -817,17 +830,32 @@ irnet_connect_socket(irnet_socket * self
 #endif /* STREAM_COMPAT */
 
   /* Clean up the original one to keep it in listen state */
-  self->tsap->dtsap_sel = self->tsap->lsap->dlsap_sel = LSAP_ANY;
-  self->tsap->lsap->lsap_state = LSAP_DISCONNECTED;
+  server->tsap->dtsap_sel = server->tsap->lsap->dlsap_sel = LSAP_ANY;
+  server->tsap->lsap->lsap_state = LSAP_DISCONNECTED;
 
   /* Send a connection response on the new socket */
   irttp_connect_response(new->tsap, new->max_sdu_size_rx, NULL);
 
   /* Allow PPP to send its junk over the new socket... */
-  new->ttp_open = 1;
-  new->ttp_connect = 0;
+  set_bit(0, &new->ttp_open);
+
+  /* Not connecting anymore, and clean up last possible remains
+   * of connection attempts on the socket */
+  clear_bit(0, &new->ttp_connect);
+  if(new->iriap)
+    {
+      iriap_close(new->iriap);
+      new->iriap = NULL;
+    }
+  if(new->discoveries != NULL)
+    {
+      kfree(new->discoveries);
+      new->discoveries = NULL;
+    }
+
 #ifdef CONNECT_INDIC_KICK
-  /* As currently we don't packets in ppp_irnet_send(), this is not needed...
+  /* As currently we don't block packets in ppp_irnet_send() while passive,
+   * this is not really needed...
    * Also, not doing it give IrDA a chance to finish the setup properly
    * before beeing swamped with packets... */
   ppp_output_wakeup(&new->chan);
@@ -835,7 +863,7 @@ irnet_connect_socket(irnet_socket *   self
 
   /* Notify the control channel */
   irnet_post_event(new, IRNET_CONNECT_FROM,
-                  new->saddr, new->daddr, self->rname);
+                  new->saddr, new->daddr, server->rname);
 
   DEXIT(IRDA_SERV_TRACE, "\n");
   return 0;
@@ -1053,12 +1081,33 @@ irnet_disconnect_indication(void *        insta
                            struct sk_buff *skb)
 {
   irnet_socket *       self = (irnet_socket *) instance;
+  int                  test = 0;
 
   DENTER(IRDA_TCB_TRACE, "(self=0x%X)\n", (unsigned int) self);
   DASSERT(self != NULL, , IRDA_CB_ERROR, "Self is NULL !!!\n");
 
+  /* Don't care about it, but let's not leak it */
+  if(skb)
+    dev_kfree_skb(skb);
+
+  /* Prevent higher layer from accessing IrTTP */
+  test = test_and_clear_bit(0, &self->ttp_open);
+  /* Not connecting anymore...
+   * (note : TSAP is open, so IAP callbacks are no longer pending...) */
+  test |= test_and_clear_bit(0, &self->ttp_connect);
+
+  /* If both self->ttp_open and self->ttp_connect are NULL, it mean that we
+   * have a race condition with irda_irnet_destroy() or
+   * irnet_connect_indication(), so don't mess up tsap...
+   */
+  if(!test)
+    {
+      DERROR(IRDA_CB_ERROR, "Race condition detected...\n");
+      return;
+    }
+
   /* If we were active, notify the control channel */
-  if(self->ttp_open)
+  if(test_bit(0, &self->ttp_open))
     irnet_post_event(self, IRNET_DISCONNECT_FROM,
                     self->saddr, self->daddr, self->rname);
   else
@@ -1067,15 +1116,10 @@ irnet_disconnect_indication(void *        insta
       irnet_post_event(self, IRNET_NOANSWER_FROM,
                       self->saddr, self->daddr, self->rname);
 
-  /* Prevent higher layer from accessing IrTTP */
-  self->ttp_open = 0;
-  self->ttp_connect = 0;
-
-  /* Close our IrTTP connection */
+  /* Close our IrTTP connection, cleanup tsap */
   if((self->tsap) && (self != &irnet_server.s))
     {
       DEBUG(IRDA_CB_INFO, "Closing our TTP connection.\n");
-      irttp_disconnect_request(self->tsap, NULL, P_NORMAL);
       irttp_close_tsap(self->tsap);
       self->tsap = NULL;
 
@@ -1114,6 +1158,13 @@ irnet_connect_confirm(void *       instance,
 
   DENTER(IRDA_TCB_TRACE, "(self=0x%X)\n", (unsigned int) self);
 
+  /* Check if socket is closing down (via irda_irnet_destroy()) */
+  if(! test_bit(0, &self->ttp_connect))
+    {
+      DERROR(IRDA_CB_ERROR, "Socket no longer connecting. Ouch !\n");
+      return;
+    }
+
   /* How much header space do we need to reserve */
   self->max_header_size = max_header_size;
 
@@ -1129,8 +1180,8 @@ irnet_connect_confirm(void *        instance,
   self->saddr = irttp_get_saddr(self->tsap);
 
   /* Allow higher layer to access IrTTP */
-  self->ttp_connect = 0;
-  self->ttp_open = 1;
+  set_bit(0, &self->ttp_open);
+  clear_bit(0, &self->ttp_connect);    /* Not racy, IrDA traffic is serial */
   /* Give a kick in the ass of ppp_generic so that he sends us some data */
   ppp_output_wakeup(&self->chan);
 
@@ -1251,56 +1302,76 @@ irnet_connect_indication(void *           instanc
                         __u8           max_header_size,
                         struct sk_buff *skb)
 {
-  irnet_socket *       self = &irnet_server.s;
+  irnet_socket *       server = &irnet_server.s;
   irnet_socket *       new = (irnet_socket *) NULL;
 
-  DENTER(IRDA_TCB_TRACE, "(self=0x%X)\n", (unsigned int) self);
+  DENTER(IRDA_TCB_TRACE, "(server=0x%X)\n", (unsigned int) server);
   DASSERT(instance == &irnet_server, , IRDA_CB_ERROR,
          "Invalid instance (0x%X) !!!\n", (unsigned int) instance);
   DASSERT(sap == irnet_server.s.tsap, , IRDA_CB_ERROR, "Invalid sap !!!\n");
 
   /* Try to find the most appropriate IrNET socket */
-  new = irnet_find_socket(self);
+  new = irnet_find_socket(server);
 
   /* After all this hard work, do we have an socket ? */
   if(new == (irnet_socket *) NULL)
     {
       DEXIT(IRDA_CB_INFO, ": No socket waiting for this connection.\n");
-      irnet_disconnect_server(self, skb);
+      irnet_disconnect_server(server, skb);
       return;
     }
 
   /* Is the socket already busy ? */
-  if(new->ttp_open)
+  if(test_bit(0, &new->ttp_open))
     {
       DEXIT(IRDA_CB_INFO, ": Socket already connected.\n");
-      irnet_disconnect_server(self, skb);
+      irnet_disconnect_server(server, skb);
       return;
     }
 
-  /* Socket connecting */
-  if(new->tsap != NULL)
-    {
-      /* The socket has sent a IrTTP connection request and is waiting for
-       * a connection response (that may never come).
-       * Now, the pain is that the socket has open a tsap and is waiting on it,
-       * while the other end is trying to connect to it on another tsap.
-       * Argh ! We will deal with that later...
+  /* Socket connecting ?
+   * Clear up flag : prevent irnet_disconnect_indication() to mess up tsap */
+  if(test_and_clear_bit(0, &new->ttp_connect))
+    {
+      /* The socket is trying to connect to the other end and may have sent
+       * a IrTTP connection request and is waiting for a connection response
+       * (that may never come).
+       * Now, the pain is that the socket may have opened a tsap and is
+       * waiting on it, while the other end is trying to connect to it on
+       * another tsap.
        */
       DERROR(IRDA_CB_ERROR, "Socket already connecting. Ouch !\n");
 #ifdef ALLOW_SIMULT_CONNECT
-      /* Close the connection the new socket was attempting.
-       * WARNING : This need more testing ! */
-      irttp_close_tsap(new->tsap);
+      /* Cleanup the TSAP if necessary - IrIAP will be cleaned up later */
+      if(new->tsap != NULL)
+       {
+         /* Close the connection the new socket was attempting.
+          * This seems to be safe... */
+         irttp_close_tsap(new->tsap);
+         new->tsap = NULL;
+       }
       /* Note : no return, fall through... */
 #else /* ALLOW_SIMULT_CONNECT */
-      irnet_disconnect_server(self, skb);
+      irnet_disconnect_server(server, skb);
       return;
 #endif /* ALLOW_SIMULT_CONNECT */
     }
+  else
+    /* If socket is not connecting or connected, tsap should be NULL */
+    if(new->tsap != NULL)
+      {
+       /* If we are here, we are also in irnet_disconnect_indication(),
+        * and it's a nice race condition... On the other hand, we can't be
+        * in irda_irnet_destroy() otherwise we would not have found the
+        * socket in the hashbin. */
+       /* Better get out of here, otherwise we will mess up tsaps ! */
+       DERROR(IRDA_CB_ERROR, "Race condition detected, abort connect...\n");
+       irnet_disconnect_server(server, skb);
+       return;
+      }
 
   /* So : at this point, we have a socket, and it is idle. Good ! */
-  irnet_connect_socket(self, new, qos, max_sdu_size, max_header_size);
+  irnet_connect_socket(server, new, qos, max_sdu_size, max_header_size);
 
   /* Check size of received packet */
   if(skb->len > 0)
@@ -1349,24 +1420,25 @@ irnet_getvalue_confirm(int        result,
   DENTER(IRDA_OCB_TRACE, "(self=0x%X)\n", (unsigned int) self);
   DASSERT(self != NULL, , IRDA_OCB_ERROR, "Self is NULL !!!\n");
 
-  /* We probably don't need to make any more queries */
-  iriap_close(self->iriap);
-  self->iriap = NULL;
-
-  /* Check if already connected (via irnet_connect_socket()) */
-  if(self->ttp_open)
+  /* Check if already connected (via irnet_connect_socket())
+   * or socket is closing down (via irda_irnet_destroy()) */
+  if(! test_bit(0, &self->ttp_connect))
     {
-      DERROR(IRDA_OCB_ERROR, "Socket already connected. Ouch !\n");
+      DERROR(IRDA_OCB_ERROR, "Socket no longer connecting. Ouch !\n");
       return;
     }
 
+  /* We probably don't need to make any more queries */
+  iriap_close(self->iriap);
+  self->iriap = NULL;
+
   /* Post process the IAS reply */
   self->dtsap_sel = irnet_ias_to_tsap(self, result, value);
 
   /* If error, just go out */
   if(self->errno)
     {
-      self->ttp_connect = 0;
+      clear_bit(0, &self->ttp_connect);
       DERROR(IRDA_OCB_ERROR, "IAS connect failed ! (0x%X)\n", self->errno);
       return;
     }
@@ -1412,6 +1484,14 @@ irnet_discovervalue_confirm(int            result,
   DENTER(IRDA_OCB_TRACE, "(self=0x%X)\n", (unsigned int) self);
   DASSERT(self != NULL, , IRDA_OCB_ERROR, "Self is NULL !!!\n");
 
+  /* Check if already connected (via irnet_connect_socket())
+   * or socket is closing down (via irda_irnet_destroy()) */
+  if(! test_bit(0, &self->ttp_connect))
+    {
+      DERROR(IRDA_OCB_ERROR, "Socket no longer connecting. Ouch !\n");
+      return;
+    }
+
   /* Post process the IAS reply */
   dtsap_sel = irnet_ias_to_tsap(self, result, value);
 
@@ -1468,15 +1548,8 @@ irnet_discovervalue_confirm(int            result,
   if(self->daddr == DEV_ADDR_ANY)
     {
       self->daddr = DEV_ADDR_ANY;
-      self->ttp_connect = 0;
+      clear_bit(0, &self->ttp_connect);
       DEXIT(IRDA_OCB_TRACE, ": cannot discover IrNET in any device !!!\n");
-      return;
-    }
-
-  /* Check if already connected (via irnet_connect_socket()) */
-  if(self->ttp_open)
-    {
-      DERROR(IRDA_OCB_ERROR, "Socket already connected. Ouch !\n");
       return;
     }
 
diff -u -p linux/net/irda/irnet/irnet_ppp.d2.c linux/net/irda/irnet/irnet_ppp.c
--- linux/net/irda/irnet/irnet_ppp.d2.c Thu Nov  1 12:14:43 2001
+++ linux/net/irda/irnet/irnet_ppp.c    Thu Nov  1 14:11:53 2001
@@ -850,7 +850,7 @@ ppp_irnet_send(struct ppp_channel *   chan
   DASSERT(self != NULL, 0, PPP_ERROR, "Self is NULL !!!\n");
 
   /* Check if we are connected */
-  if(self->ttp_open == 0)
+  if(!(test_bit(0, &self->ttp_open)))
     {
 #ifdef CONNECT_IN_SEND
       /* Let's try to connect one more time... */
@@ -884,7 +884,7 @@ ppp_irnet_send(struct ppp_channel *   chan
        */
 #ifdef BLOCK_WHEN_CONNECT
       /* If we are attempting to connect */
-      if(self->ttp_connect)
+      if(test_bit(0, &self->ttp_connect))
        {
          /* Blocking packet, ppp_generic will retry later */
          return 0;
