summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorPauli Virtanen <pav@iki.fi>2023-07-27 00:25:26 +0300
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>2023-08-11 11:52:32 -0700
commit69997d50ec574be816b4ee8f9cee52ebbd53f8bd (patch)
tree5f698d3a2fde6f2eb491bb77d8f3986ee3bfad06 /net
parent90005880a68cc8908885f5c9c9e2e60deaf78700 (diff)
Bluetooth: ISO: handle bound CIS cleanup via hci_conn
Calling hci_conn_del in __iso_sock_close is invalid. It needs hdev->lock, but it cannot be acquired there due to lock ordering. Fix this by doing cleanup via hci_conn_drop. Return hci_conn with refcount 1 from hci_bind_cis and hci_connect_cis, so that the iso_conn always holds one reference. This also fixes refcounting when error handling. Since hci_conn_abort shall handle termination of connections in any state properly, we can handle BT_CONNECT socket state in the same way as BT_CONNECTED. Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/hci_conn.c5
-rw-r--r--net/bluetooth/iso.c14
2 files changed, 6 insertions, 13 deletions
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index cccc2b8b60a8..923bb7e7be2b 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1909,6 +1909,8 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
return ERR_PTR(-EINVAL);
}
+ hci_conn_hold(cis);
+
cis->iso_qos = *qos;
cis->state = BT_BOUND;
@@ -2262,6 +2264,9 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
return ERR_PTR(-ENOLINK);
}
+ /* Link takes the refcount */
+ hci_conn_drop(cis);
+
cis->state = BT_CONNECT;
hci_le_create_cis_pending(hdev);
diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index cbe3299b4a41..358954bfbb32 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -628,6 +628,7 @@ static void __iso_sock_close(struct sock *sk)
iso_sock_cleanup_listen(sk);
break;
+ case BT_CONNECT:
case BT_CONNECTED:
case BT_CONFIG:
if (iso_pi(sk)->conn->hcon) {
@@ -645,19 +646,6 @@ static void __iso_sock_close(struct sock *sk)
case BT_CONNECT2:
iso_chan_del(sk, ECONNRESET);
break;
- case BT_CONNECT:
- /* In case of DEFER_SETUP the hcon would be bound to CIG which
- * needs to be removed so just call hci_conn_del so the cleanup
- * callback do what is needed.
- */
- if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags) &&
- iso_pi(sk)->conn->hcon) {
- hci_conn_del(iso_pi(sk)->conn->hcon);
- iso_pi(sk)->conn->hcon = NULL;
- }
-
- iso_chan_del(sk, ECONNRESET);
- break;
case BT_DISCONN:
iso_chan_del(sk, ECONNRESET);
break;