Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8d7e1c7f authored by Andrei Emeltchenko's avatar Andrei Emeltchenko Committed by Gustavo Padovan
Browse files

Bluetooth: Fix memory leaks due to chan refcnt 



When we queue delayed work we hold(chan) and delayed work
shall put(chan) after execution.

Signed-off-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: default avatarGustavo Padovan <gustavo@padovan.org>
parent 94324962

net/bluetooth/l2cap_core.c

+3 −0
Original line number Diff line number Diff line
@@ -1309,6 +1309,7 @@ static void l2cap_monitor_timeout(struct work_struct *work) 
	if (chan->retry_count >= chan->remote_max_tx) {

		l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);

		l2cap_chan_unlock(chan);

		l2cap_chan_put(chan);

		return;

	}
@@ -1317,6 +1318,7 @@ static void l2cap_monitor_timeout(struct work_struct *work) 


	l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);

	l2cap_chan_unlock(chan);

	l2cap_chan_put(chan);

}



static void l2cap_retrans_timeout(struct work_struct *work)
@@ -1336,6 +1338,7 @@ static void l2cap_retrans_timeout(struct work_struct *work) 
	l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);



	l2cap_chan_unlock(chan);

	l2cap_chan_put(chan);

}



static void l2cap_drop_acked_frames(struct l2cap_chan *chan)