Commit 15f32cab authored by Pauli Virtanen's avatar Pauli Virtanen Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: 6lowpan: add missing l2cap_chan_lock() 



l2cap_chan_close() needs to be called in l2cap_chan_lock(), otherwise
l2cap_le_sig_cmd() etc. may run concurrently.

Add missing locks around l2cap_chan_close().

Fixes: 6b8d4a6a ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Signed-off-by: default avatarPauli Virtanen <pav@iki.fi>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 98454bc8

net/bluetooth/6lowpan.c

+8 −0
Original line number Diff line number Diff line
@@ -927,7 +927,9 @@ static int bt_6lowpan_disconnect(struct l2cap_conn *conn, u8 dst_type) 


	BT_DBG("peer %p chan %p", peer, peer->chan);



	l2cap_chan_lock(peer->chan);

	l2cap_chan_close(peer->chan, ENOENT);

	l2cap_chan_unlock(peer->chan);



	return 0;

}
@@ -1089,7 +1091,9 @@ static void do_enable_set(struct work_struct *work) 


	mutex_lock(&set_lock);

	if (listen_chan) {

		l2cap_chan_lock(listen_chan);

		l2cap_chan_close(listen_chan, 0);

		l2cap_chan_unlock(listen_chan);

		l2cap_chan_put(listen_chan);

	}
@@ -1148,7 +1152,9 @@ static ssize_t lowpan_control_write(struct file *fp, 


		mutex_lock(&set_lock);

		if (listen_chan) {

			l2cap_chan_lock(listen_chan);

			l2cap_chan_close(listen_chan, 0);

			l2cap_chan_unlock(listen_chan);

			l2cap_chan_put(listen_chan);

			listen_chan = NULL;

		}
@@ -1310,7 +1316,9 @@ static void __exit bt_6lowpan_exit(void) 
	debugfs_remove(lowpan_control_debugfs);



	if (listen_chan) {

		l2cap_chan_lock(listen_chan);

		l2cap_chan_close(listen_chan, 0);

		l2cap_chan_unlock(listen_chan);

		l2cap_chan_put(listen_chan);

	}