Bluetooth: Free the l2cap channel list only when refcount is zero

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=4af66c691f4e5c2db9bb00793669a548e9db1974
Commit:     4af66c691f4e5c2db9bb00793669a548e9db1974
Parent:     3064837289259843310b266a9422aca5f5b4b9c7
Author:     Jaganath Kanakkassery <jaganath.k at samsung.com>
AuthorDate: Fri Jul 13 18:17:55 2012 +0530
Committer:  Gustavo Padovan <gustavo.padovan at collabora.co.uk>
CommitDate: Mon Aug 6 15:02:58 2012 -0300

    Bluetooth: Free the l2cap channel list only when refcount is zero
    
    Move the l2cap channel list chan->global_l under the refcnt
    protection and free it based on the refcnt.
    
    Signed-off-by: Jaganath Kanakkassery <jaganath.k at samsung.com>
    Signed-off-by: Syam Sidhardhan <s.syam at samsung.com>
    Reviewed-by: Andrei Emeltchenko <andrei.emeltchenko at intel.com>
    Signed-off-by: Gustavo Padovan <gustavo.padovan at collabora.co.uk>
---
 include/net/bluetooth/l2cap.h |    1 -
 net/bluetooth/a2mp.c          |    2 +-
 net/bluetooth/l2cap_core.c    |    8 +++++---
 net/bluetooth/l2cap_sock.c    |    2 +-
 4 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index a1eb678..d206296 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -759,7 +759,6 @@ int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid);
 
 struct l2cap_chan *l2cap_chan_create(void);
 void l2cap_chan_close(struct l2cap_chan *chan, int reason);
-void l2cap_chan_destroy(struct l2cap_chan *chan);
 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
 		       bdaddr_t *dst, u8 dst_type);
 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 79af661..0760d1f 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -416,7 +416,7 @@ static int a2mp_chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 
 static void a2mp_chan_close_cb(struct l2cap_chan *chan)
 {
-	l2cap_chan_destroy(chan);
+	l2cap_chan_put(chan);
 }
 
 static void a2mp_chan_state_change_cb(struct l2cap_chan *chan, int state)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 79923d8..9f8b29e 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -416,13 +416,15 @@ struct l2cap_chan *l2cap_chan_create(void)
 	return chan;
 }
 
-void l2cap_chan_destroy(struct l2cap_chan *chan)
+static void l2cap_chan_destroy(struct l2cap_chan *chan)
 {
+	BT_DBG("chan %p", chan);
+
 	write_lock(&chan_list_lock);
 	list_del(&chan->global_l);
 	write_unlock(&chan_list_lock);
 
-	l2cap_chan_put(chan);
+	kfree(chan);
 }
 
 void l2cap_chan_hold(struct l2cap_chan *c)
@@ -437,7 +439,7 @@ void l2cap_chan_put(struct l2cap_chan *c)
 	BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->refcnt));
 
 	if (atomic_dec_and_test(&c->refcnt))
-		kfree(c);
+		l2cap_chan_destroy(c);
 }
 
 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index a4bb27e..79350d1 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -823,7 +823,7 @@ static void l2cap_sock_kill(struct sock *sk)
 
 	/* Kill poor orphan */
 
-	l2cap_chan_destroy(l2cap_pi(sk)->chan);
+	l2cap_chan_put(l2cap_pi(sk)->chan);
 	sock_set_flag(sk, SOCK_DEAD);
 	sock_put(sk);
 }