Commit 69997d50 authored by Pauli Virtanen's avatar Pauli Virtanen Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: ISO: handle bound CIS cleanup via hci_conn 



Calling hci_conn_del in __iso_sock_close is invalid. It needs
hdev->lock, but it cannot be acquired there due to lock ordering.

Fix this by doing cleanup via hci_conn_drop.

Return hci_conn with refcount 1 from hci_bind_cis and hci_connect_cis,
so that the iso_conn always holds one reference.  This also fixes
refcounting when error handling.

Since hci_conn_abort shall handle termination of connections in any
state properly, we can handle BT_CONNECT socket state in the same way as
BT_CONNECTED.

Signed-off-by: default avatarPauli Virtanen <pav@iki.fi>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 90005880

net/bluetooth/hci_conn.c

+5 −0
Original line number Diff line number Diff line
@@ -1909,6 +1909,8 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, 
		return ERR_PTR(-EINVAL);

	}



	hci_conn_hold(cis);



	cis->iso_qos = *qos;

	cis->state = BT_BOUND;
@@ -2262,6 +2264,9 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst, 
		return ERR_PTR(-ENOLINK);

	}



	/* Link takes the refcount */

	hci_conn_drop(cis);



	cis->state = BT_CONNECT;



	hci_le_create_cis_pending(hdev);

net/bluetooth/iso.c

+1 −13
Original line number Diff line number Diff line
@@ -628,6 +628,7 @@ static void __iso_sock_close(struct sock *sk) 
		iso_sock_cleanup_listen(sk);

		break;



	case BT_CONNECT:

	case BT_CONNECTED:

	case BT_CONFIG:

		if (iso_pi(sk)->conn->hcon) {
@@ -643,19 +644,6 @@ static void __iso_sock_close(struct sock *sk) 
		break;



	case BT_CONNECT2:

		iso_chan_del(sk, ECONNRESET);

		break;

	case BT_CONNECT:

		/* In case of DEFER_SETUP the hcon would be bound to CIG which

		 * needs to be removed so just call hci_conn_del so the cleanup

		 * callback do what is needed.

		 */

		if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags) &&

		    iso_pi(sk)->conn->hcon) {

			hci_conn_del(iso_pi(sk)->conn->hcon);

			iso_pi(sk)->conn->hcon = NULL;

		}



		iso_chan_del(sk, ECONNRESET);

		break;

	case BT_DISCONN: