Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 08829a8f authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Greg Kroah-Hartman
Browse files

Bluetooth: hci_core: Fix LE quote calculation 

[ Upstream commit 932021a11805b9da4bd6abf66fe233cccd59fe0e ]

Function hci_sched_le needs to update the respective counter variable
inplace other the likes of hci_quote_sent would attempt to use the
possible outdated value of conn->{le_cnt,acl_cnt}.

Link: https://github.com/bluez/bluez/issues/915


Fixes: 73d80deb ("Bluetooth: prioritizing data over HCI")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent edb7dbcf

net/bluetooth/hci_core.c

+7 −12
Original line number Diff line number Diff line
@@ -4121,19 +4121,19 @@ static void hci_sched_le(struct hci_dev *hdev) 
{

	struct hci_chan *chan;

	struct sk_buff *skb;

	int quote, cnt, tmp;

	int quote, *cnt, tmp;



	BT_DBG("%s", hdev->name);



	if (!hci_conn_num(hdev, LE_LINK))

		return;



	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;

	cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;



	__check_timeout(hdev, cnt, LE_LINK);

	__check_timeout(hdev, *cnt, LE_LINK);



	tmp = cnt;

	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {

	tmp = *cnt;

	while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {

		u32 priority = (skb_peek(&chan->data_q))->priority;

		while (quote-- && (skb = skb_peek(&chan->data_q))) {

			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
@@ -4148,18 +4148,13 @@ static void hci_sched_le(struct hci_dev *hdev) 
			hci_send_frame(hdev, skb);

			hdev->le_last_tx = jiffies;



			cnt--;

			(*cnt)--;

			chan->sent++;

			chan->conn->sent++;

		}

	}



	if (hdev->le_pkts)

		hdev->le_cnt = cnt;

	else

		hdev->acl_cnt = cnt;



	if (cnt != tmp)

	if (*cnt != tmp)

		hci_prio_recalculate(hdev, LE_LINK);

}