Commit 932021a1 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: hci_core: Fix LE quote calculation 

Function hci_sched_le needs to update the respective counter variable
inplace other the likes of hci_quote_sent would attempt to use the
possible outdated value of conn->{le_cnt,acl_cnt}.

Link: https://github.com/bluez/bluez/issues/915


Fixes: 73d80deb ("Bluetooth: prioritizing data over HCI")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent aae6b812

net/bluetooth/hci_core.c

+7 −12
Original line number Diff line number Diff line
@@ -3664,19 +3664,19 @@ static void hci_sched_le(struct hci_dev *hdev) 
{

	struct hci_chan *chan;

	struct sk_buff *skb;

	int quote, cnt, tmp;

	int quote, *cnt, tmp;



	BT_DBG("%s", hdev->name);



	if (!hci_conn_num(hdev, LE_LINK))

		return;



	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;

	cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;



	__check_timeout(hdev, cnt, LE_LINK);

	__check_timeout(hdev, *cnt, LE_LINK);



	tmp = cnt;

	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {

	tmp = *cnt;

	while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {

		u32 priority = (skb_peek(&chan->data_q))->priority;

		while (quote-- && (skb = skb_peek(&chan->data_q))) {

			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
@@ -3691,7 +3691,7 @@ static void hci_sched_le(struct hci_dev *hdev) 
			hci_send_frame(hdev, skb);

			hdev->le_last_tx = jiffies;



			cnt--;

			(*cnt)--;

			chan->sent++;

			chan->conn->sent++;
@@ -3701,12 +3701,7 @@ static void hci_sched_le(struct hci_dev *hdev) 
		}

	}



	if (hdev->le_pkts)

		hdev->le_cnt = cnt;

	else

		hdev->acl_cnt = cnt;



	if (cnt != tmp)

	if (*cnt != tmp)

		hci_prio_recalculate(hdev, LE_LINK);

}