Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e686219a authored by Gustavo Padovan's avatar Gustavo Padovan Committed by Marcel Holtmann
Browse files

Bluetooth: Add locking scheme to L2CAP timeout callbacks 



Avoid race conditions when accessing the L2CAP socket from within the
timeout handlers.

Signed-off-by: default avatarGustavo F. Padovan <gustavo@las.ic.unicamp.br>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 9e726b17

net/bluetooth/l2cap.c

+4 −0
Original line number Original line Diff line number Diff line
@@ -1192,6 +1192,7 @@ static void l2cap_monitor_timeout(unsigned long arg) 
	struct sock *sk = (void *) arg;

	struct sock *sk = (void *) arg;

	u16 control;

	u16 control;





	bh_lock_sock(sk);

	if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {

	if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {

		l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);

		l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);

		return;

		return;
@@ -1203,6 +1204,7 @@ static void l2cap_monitor_timeout(unsigned long arg) 
	control = L2CAP_CTRL_POLL;

	control = L2CAP_CTRL_POLL;

	control |= L2CAP_SUPER_RCV_READY;

	control |= L2CAP_SUPER_RCV_READY;

	l2cap_send_sframe(l2cap_pi(sk), control);

	l2cap_send_sframe(l2cap_pi(sk), control);

	bh_unlock_sock(sk);

}

}





static void l2cap_retrans_timeout(unsigned long arg)

static void l2cap_retrans_timeout(unsigned long arg)
@@ -1210,6 +1212,7 @@ static void l2cap_retrans_timeout(unsigned long arg) 
	struct sock *sk = (void *) arg;

	struct sock *sk = (void *) arg;

	u16 control;

	u16 control;





	bh_lock_sock(sk);

	l2cap_pi(sk)->retry_count = 1;

	l2cap_pi(sk)->retry_count = 1;

	__mod_monitor_timer();

	__mod_monitor_timer();
@@ -1218,6 +1221,7 @@ static void l2cap_retrans_timeout(unsigned long arg) 
	control = L2CAP_CTRL_POLL;

	control = L2CAP_CTRL_POLL;

	control |= L2CAP_SUPER_RCV_READY;

	control |= L2CAP_SUPER_RCV_READY;

	l2cap_send_sframe(l2cap_pi(sk), control);

	l2cap_send_sframe(l2cap_pi(sk), control);

	bh_unlock_sock(sk);

}

}





static void l2cap_drop_acked_frames(struct sock *sk)

static void l2cap_drop_acked_frames(struct sock *sk)