Commit 09bfb2ee authored Jan 11, 2012 by Szymon Janc Committed by Johan Hedberg Feb 13, 2012

Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired



Reference counter was incremented when starting ack timer but
decremented only when clearing timer, not when timer fired.

Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

parent 77f918bc

net/bluetooth/l2cap_core.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1996,6 +1996,8 @@ static void l2cap_ack_timeout(struct work_struct *work)
		lock_sock(chan->sk);
		__l2cap_send_ack(chan);
		release_sock(chan->sk);

		l2cap_chan_put(chan);
		}

		static inline void l2cap_ertm_init(struct l2cap_chan *chan)