Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2827011f authored by Mat Martineau's avatar Mat Martineau Committed by Johan Hedberg
Browse files

Bluetooth: Fix early return from l2cap_chan_del 



This fixes a regression from commit
2ead70b8 that is present in all
kernels starting at v3.0.

When L2CAP information was moved to struct l2cap_chan, a check was
added to l2cap_chan_del to avoid certain cleanup operations when ERTM
or streaming mode had not yet been initialized.  The logic in the
check did not take in to account that chan->conf_state is set to 0 in
l2cap_chan_ready, so l2cap_chan_del failed to cancel timers and leaked
memory any time the ERTM queues or lists were not empty.

This change makes sure that l2cap_chan_del only returns early if
ERTM initialization was not performed.

Signed-off-by: default avatarMat Martineau <mathewm@codeaurora.org>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 9dc9affc

include/net/bluetooth/l2cap.h

+1 −0
Original line number Diff line number Diff line
@@ -597,6 +597,7 @@ enum { 
	CONF_EWS_RECV,

	CONF_LOC_CONF_PEND,

	CONF_REM_CONF_PEND,

	CONF_NOT_COMPLETE,

};



#define L2CAP_CONF_MAX_CONF_REQ 2

net/bluetooth/l2cap_core.c

+5 −2
Original line number Diff line number Diff line
@@ -392,6 +392,9 @@ struct l2cap_chan *l2cap_chan_create(void) 


	atomic_set(&chan->refcnt, 1);



	/* This flag is cleared in l2cap_chan_ready() */

	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);



	BT_DBG("chan %p", chan);



	return chan;
@@ -509,8 +512,7 @@ static void l2cap_chan_del(struct l2cap_chan *chan, int err) 


	release_sock(sk);



	if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&

			test_bit(CONF_INPUT_DONE, &chan->conf_state)))

	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))

		return;



	skb_queue_purge(&chan->tx_q);
@@ -923,6 +925,7 @@ static void l2cap_chan_ready(struct l2cap_chan *chan) 


	BT_DBG("sk %p, parent %p", sk, parent);



	/* This clears all conf flags, including CONF_NOT_COMPLETE */

	chan->conf_state = 0;

	__clear_chan_timer(chan);