Bluetooth: Fix memory leaks due to chan refcnt
authorAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Fri, 23 Mar 2012 07:42:15 +0000 (09:42 +0200)
committerGustavo Padovan <gustavo@padovan.org>
Wed, 28 Mar 2012 15:02:39 +0000 (12:02 -0300)
When we queue delayed work we hold(chan) and delayed work
shall put(chan) after execution.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
net/bluetooth/l2cap_core.c

index 3e450f4..38d934a 100644 (file)
@@ -1309,6 +1309,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
        if (chan->retry_count >= chan->remote_max_tx) {
                l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
                l2cap_chan_unlock(chan);
+               l2cap_chan_put(chan);
                return;
        }
 
@@ -1317,6 +1318,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
 
        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
        l2cap_chan_unlock(chan);
+       l2cap_chan_put(chan);
 }
 
 static void l2cap_retrans_timeout(struct work_struct *work)
@@ -1336,6 +1338,7 @@ static void l2cap_retrans_timeout(struct work_struct *work)
        l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
 
        l2cap_chan_unlock(chan);
+       l2cap_chan_put(chan);
 }
 
 static void l2cap_drop_acked_frames(struct l2cap_chan *chan)