forked from luck/tmp_suning_uos_patched
ef191aded5
As the comment for l2cap_get_chan_by_scid indicated, the function used to return a locked socket. The lock for the socket was acquired while the channel list was also locked. When locking was moved over to the l2cap_chan structure, the channel lock was no longer acquired with the channel list still locked. This made it possible for the l2cap_chan to be deleted after conn->chan_lock was released but before l2cap_chan_lock was called. Making the call to l2cap_chan_lock before releasing conn->chan_lock makes it impossible for the l2cap_chan to be deleted at the wrong time. Signed-off-by: Mat Martineau <mathewm@codeaurora.org> Reviewed-by: Ulisses Furquim <ulisses@profusion.mobi> Signed-off-by: Gustavo Padovan <gustavo@padovan.org> |
||
---|---|---|
.. | ||
bnep | ||
cmtp | ||
hidp | ||
rfcomm | ||
af_bluetooth.c | ||
hci_conn.c | ||
hci_core.c | ||
hci_event.c | ||
hci_sock.c | ||
hci_sysfs.c | ||
Kconfig | ||
l2cap_core.c | ||
l2cap_sock.c | ||
lib.c | ||
Makefile | ||
mgmt.c | ||
sco.c | ||
smp.c |