diff options
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 28 |
1 files changed, 16 insertions, 12 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 644e31160d55..8bd4fff63d50 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -109,7 +109,7 @@ static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, } /* Find channel with given SCID. - * Returns a reference locked channel. + * Returns a reference. */ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) @@ -117,18 +117,14 @@ static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, struct l2cap_chan *c; c = __l2cap_get_chan_by_scid(conn, cid); - if (c) { - /* Only lock if chan reference is not 0 */ + if (c) c = l2cap_chan_hold_unless_zero(c); - if (c) - l2cap_chan_lock(c); - } return c; } /* Find channel with given DCID. - * Returns a reference locked channel. + * Returns a reference. */ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid) @@ -136,12 +132,8 @@ static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, struct l2cap_chan *c; c = __l2cap_get_chan_by_dcid(conn, cid); - if (c) { - /* Only lock if chan reference is not 0 */ + if (c) c = l2cap_chan_hold_unless_zero(c); - if (c) - l2cap_chan_lock(c); - } return c; } @@ -4382,6 +4374,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, return 0; } + l2cap_chan_lock(chan); + if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && chan->state != BT_CONNECTED) { cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, @@ -4493,6 +4487,8 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, if (!chan) return 0; + l2cap_chan_lock(chan); + switch (result) { case L2CAP_CONF_SUCCESS: l2cap_conf_rfc_get(chan, rsp->data, len); @@ -4599,6 +4595,8 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, return 0; } + l2cap_chan_lock(chan); + rsp.dcid = cpu_to_le16(chan->scid); rsp.scid = cpu_to_le16(chan->dcid); l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); @@ -4636,6 +4634,8 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, return 0; } + l2cap_chan_lock(chan); + if (chan->state != BT_DISCONN) { l2cap_chan_unlock(chan); l2cap_chan_put(chan); @@ -5139,6 +5139,8 @@ static inline int l2cap_le_credits(struct l2cap_conn *conn, if (!chan) return -EBADSLT; + l2cap_chan_lock(chan); + max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits; if (credits > max_credits) { BT_ERR("LE credits overflow"); @@ -6998,6 +7000,8 @@ static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, return; } + l2cap_chan_lock(chan); + BT_DBG("chan %p, len %d", chan, skb->len); /* If we receive data on a fixed channel before the info req/rsp |