From: Szymon Janc Date: Wed, 11 Jan 2012 09:59:49 +0000 (+0100) Subject: Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired X-Git-Tag: archive/raspbian/4.9.13-1+rpi1~10^2~11655^2~112^2~228 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks:///%22http:/www.example.com/cgi/%22https:/%22bookmarks:/?a=commitdiff_plain;h=09bfb2ee52a66845bbefad0b6eaeae1b5adea949;p=linux-4.9.git Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired Reference counter was incremented when starting ack timer but decremented only when clearing timer, not when timer fired. Signed-off-by: Szymon Janc Acked-by: Marcel Holtmann Signed-off-by: Johan Hedberg --- diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 778ceb2b8402..6773453927ef 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1996,6 +1996,8 @@ static void l2cap_ack_timeout(struct work_struct *work) lock_sock(chan->sk); __l2cap_send_ack(chan); release_sock(chan->sk); + + l2cap_chan_put(chan); } static inline void l2cap_ertm_init(struct l2cap_chan *chan)