summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrei Emeltchenko <andrei.emeltchenko@intel.com>2012-03-23 09:42:15 +0200
committerGustavo Padovan <gustavo@padovan.org>2012-03-28 12:02:39 -0300
commit8d7e1c7f7e5f9fe8f6279752fc33fcb77afd5001 (patch)
tree1fce3c7c9832a276399c47c407c2163f8d7dcbe6
parent94324962066231a938564bebad0f941cd2d06bb2 (diff)
downloadlinux-3.10-8d7e1c7f7e5f9fe8f6279752fc33fcb77afd5001.tar.gz
linux-3.10-8d7e1c7f7e5f9fe8f6279752fc33fcb77afd5001.tar.bz2
linux-3.10-8d7e1c7f7e5f9fe8f6279752fc33fcb77afd5001.zip
Bluetooth: Fix memory leaks due to chan refcnt
When we queue delayed work we hold(chan) and delayed work shall put(chan) after execution. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
-rw-r--r--net/bluetooth/l2cap_core.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 3e450f4a312..38d934a1124 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1309,6 +1309,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
if (chan->retry_count >= chan->remote_max_tx) {
l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
return;
}
@@ -1317,6 +1318,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
}
static void l2cap_retrans_timeout(struct work_struct *work)
@@ -1336,6 +1338,7 @@ static void l2cap_retrans_timeout(struct work_struct *work)
l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
l2cap_chan_unlock(chan);
+ l2cap_chan_put(chan);
}
static void l2cap_drop_acked_frames(struct l2cap_chan *chan)