linuxmsm/laptops-kernel
0
0
Fork 0
mirror of https://github.com/linux-msm/laptops-kernel.git synced 2026-08-13 14:19:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

Browse Source 
hci_conn_get() without already held reference is data race against
concurrent deletion.

In previous patches, the refcount has been changed to be taken before
starting the hci_sync task, so remove these extra get() + put() as they
are not needed.

Fixes: 12917f591c ("Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pauli Virtanen
2026-07-28 16:13:13 -04:00
committed by Luiz Augusto von Dentz
parent 2c1e4e0061
commit c0a9dcd2be
1 changed files with 0 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/hci_sync.c
-13
View File
@@ -6741,11 +6741,6 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
bt_dev_dbg(hdev, "conn %p", conn);
/* Hold a reference so conn stays valid for the HCI_CONN_CREATE
* clear_bit() at done.
*/
hci_conn_get(conn);
clear_bit(HCI_CONN_SCANNING, &conn->flags);
conn->state = BT_CONNECT;
@@ -6760,7 +6755,6 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
conn->state = BT_OPEN;
hci_abort_conn_sync(hdev, conn,
HCI_ERROR_REJ_LIMITED_RESOURCES);
hci_conn_put(conn);
return -EBUSY;
}
@@ -6858,7 +6852,6 @@ done:
/* Re-enable advertising after the connection attempt is finished. */
hci_resume_advertising_sync(hdev);
hci_conn_put(conn);
return err;
}
@@ -7133,11 +7126,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
else
cp.role_switch = 0x00;
/* Hold a reference so conn stays valid for the HCI_CONN_CREATE
* clear_bit() below.
*/
hci_conn_get(conn);
/* Mark create connection in flight so hci_cancel_connect_sync() can
* cancel it while blocking on the connection complete event.
*/
@@ -7149,7 +7137,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
conn->conn_timeout, NULL);
clear_bit(HCI_CONN_CREATE, &conn->flags);
hci_conn_put(conn);
return err;
}