From: Szymon Janc <szymon.janc@tieto.com>
Date: Wed, 11 Jan 2012 09:59:49 +0000 (+0100)
Subject: Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired
X-Git-Tag: firefly_0821_release~3680^2~3338^2~112^2~228
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=09bfb2ee52a66845bbefad0b6eaeae1b5adea949;p=firefly-linux-kernel-4.4.55.git

Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired

Reference counter was incremented when starting ack timer but
decremented only when clearing timer, not when timer fired.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
---

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 778ceb2b8402..6773453927ef 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1996,6 +1996,8 @@ static void l2cap_ack_timeout(struct work_struct *work)
 	lock_sock(chan->sk);
 	__l2cap_send_ack(chan);
 	release_sock(chan->sk);
+
+	l2cap_chan_put(chan);
 }
 
 static inline void l2cap_ertm_init(struct l2cap_chan *chan)