Commit 15013aeb authored Dec 11, 2014 by Johan Hedberg Committed by Marcel Holtmann Dec 11, 2014

Bluetooth: Fix calling hci_conn_put too early



The pairing_complete() function relies on a hci_conn reference to be
able to access the hci_conn object. It should therefore only release
this reference once it's done accessing the object, i.e. at the end of
the function.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

parent 417287de

net/bluetooth/mgmt.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -3115,14 +3115,14 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
		conn->disconn_cfm_cb = NULL;

		hci_conn_drop(conn);
		hci_conn_put(conn);

		mgmt_pending_remove(cmd);

		/* The device is paired so there is no need to remove
		* its connection parameters anymore.
		*/
		clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);

		hci_conn_put(conn);
		}

		void mgmt_smp_complete(struct hci_conn *conn, bool complete)