From: Johan Hedberg <johan.hedberg@intel.com>
Date: Fri, 8 Aug 2014 06:28:03 +0000 (+0300)
Subject: Bluetooth: Call L2CAP teardown callback before clearing chan->conn
X-Git-Tag: firefly_0821_release~176^2~3043^2~133^2~84^2~33
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=72847ce02180e8a0be1b23ba53ffe437cdb25d6a;p=firefly-linux-kernel-4.4.55.git

Bluetooth: Call L2CAP teardown callback before clearing chan->conn

L2CAP channel implementations may want to still access the chan->conn
pointer. This will particularly be the case for SMP that will want to
clear a reference to the SMP channel in the l2cap_conn structure. The
only user of the teardown callback so far is l2cap_sock.c and for the
code there it makes no difference whether the callback is called before
or after clearing the chan->conn pointer.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 344a29c53227..c6419f40cfba 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -566,6 +566,8 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
 	BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
 
+	chan->ops->teardown(chan, err);
+
 	if (conn) {
 		struct amp_mgr *mgr = conn->hcon->amp_mgr;
 		/* Delete from channel list */
@@ -589,8 +591,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
 		amp_disconnect_logical_link(hs_hchan);
 	}
 
-	chan->ops->teardown(chan, err);
-
 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
 		return;