diff options
| author | Ingo Molnar <mingo@kernel.org> | 2014-07-28 10:03:00 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2014-07-28 10:03:00 +0200 |
| commit | ca5bc6cd5de5b53eb8fd6fea39aa3fe2a1e8c3d9 (patch) | |
| tree | 75beaae2d4b6bc654eb28994dd5906d8dcf5ef46 /net/bluetooth/hci_conn.c | |
| parent | c1221321b7c25b53204447cff9949a6d5a7ddddc (diff) | |
| parent | d8d28c8f00e84a72e8bee39a85835635417bee49 (diff) | |
Merge branch 'sched/urgent' into sched/core, to merge fixes before applying new changes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'net/bluetooth/hci_conn.c')
| -rw-r--r-- | net/bluetooth/hci_conn.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index ca01d1861854..a7a27bc2c0b1 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -289,10 +289,20 @@ static void hci_conn_timeout(struct work_struct *work) { struct hci_conn *conn = container_of(work, struct hci_conn, disc_work.work); + int refcnt = atomic_read(&conn->refcnt); BT_DBG("hcon %p state %s", conn, state_to_string(conn->state)); - if (atomic_read(&conn->refcnt)) + WARN_ON(refcnt < 0); + + /* FIXME: It was observed that in pairing failed scenario, refcnt + * drops below 0. Probably this is because l2cap_conn_del calls + * l2cap_chan_del for each channel, and inside l2cap_chan_del conn is + * dropped. After that loop hci_chan_del is called which also drops + * conn. For now make sure that ACL is alive if refcnt is higher then 0, + * otherwise drop it. + */ + if (refcnt > 0) return; switch (conn->state) { |