diff options
| author | Johan Hedberg <johan.hedberg@intel.com> | 2014-08-17 21:41:42 (GMT) |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2014-09-08 17:07:53 (GMT) |
| commit | 6c388d32ec1b9fcc2f2404fb5e9b3b0096be5de9 (patch) | |
| tree | d25aa7646454e2f0cbd73ce4b724c3cfa9587e84 /net | |
| parent | eb78d7e53d144995b9e023b151de19fa40af72f3 (diff) | |
| download | linux-6c388d32ec1b9fcc2f2404fb5e9b3b0096be5de9.tar.xz | |
Bluetooth: Fix hci_conn reference counting with hci_chan
The hci_chan_del() function was doing a hci_conn_drop() but there was no
matching hci_conn_hold() in the hci_chan_create() function. Furthermore,
as the hci_chan struct holds a pointer to the hci_conn there should be
proper use of hci_conn_get/put. This patch fixes both issues so that
hci_chan does correct reference counting of the hci_conn object.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/hci_conn.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 4ecc9d5..7815826 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -1295,7 +1295,8 @@ struct hci_chan *hci_chan_create(struct hci_conn *conn) if (!chan) return NULL; - chan->conn = conn; + chan->conn = hci_conn_get(conn); + hci_conn_hold(conn); skb_queue_head_init(&chan->data_q); chan->state = BT_CONNECTED; @@ -1316,6 +1317,7 @@ void hci_chan_del(struct hci_chan *chan) synchronize_rcu(); hci_conn_drop(conn); + hci_conn_put(conn); skb_queue_purge(&chan->data_q); kfree(chan); |