Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired
authorSzymon Janc <szymon.janc@tieto.com>
Wed, 11 Jan 2012 09:59:49 +0000 (10:59 +0100)
committerJohan Hedberg <johan.hedberg@intel.com>
Mon, 13 Feb 2012 15:01:26 +0000 (17:01 +0200)
Reference counter was incremented when starting ack timer but
decremented only when clearing timer, not when timer fired.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
net/bluetooth/l2cap_core.c

index 778ceb2b840294078dbcd76b67877fae6dc2df78..6773453927ef50630735f1a5896b4d6db43bfcd2 100644 (file)
@@ -1996,6 +1996,8 @@ static void l2cap_ack_timeout(struct work_struct *work)
        lock_sock(chan->sk);
        __l2cap_send_ack(chan);
        release_sock(chan->sk);
+
+       l2cap_chan_put(chan);
 }
 
 static inline void l2cap_ertm_init(struct l2cap_chan *chan)