diff options
| author | Gustavo F. Padovan <padovan@profusion.mobi> | 2011-04-21 02:47:07 +0200 |
|---|---|---|
| committer | Gustavo F. Padovan <padovan@profusion.mobi> | 2011-04-21 02:47:07 +0200 |
| commit | 828d7d7b19446bf5a40928da47955c575a454c75 (patch) | |
| tree | fd006445c562749de9a07fe6e5363bab5d285a20 /net/bluetooth | |
| parent | Bluetooth: Fix lockdep warning in L2CAP (diff) | |
| parent | iwl4965: fix skb usage after free (diff) | |
| download | linux-828d7d7b19446bf5a40928da47955c575a454c75.tar.xz linux-828d7d7b19446bf5a40928da47955c575a454c75.zip | |
Merge master.kernel.org:/pub/scm/linux/kernel/git/padovan/bluetooth-2.6
Conflicts:
net/bluetooth/l2cap_core.c
net/bluetooth/l2cap_sock.c
net/bluetooth/mgmt.c
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/hci_core.c | 1 | ||||
| -rw-r--r-- | net/bluetooth/hci_event.c | 2 | ||||
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 1 | ||||
| -rw-r--r-- | net/bluetooth/sco.c | 9 |
4 files changed, 11 insertions, 2 deletions
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index a80bc1cdb35b..98aa24b92c58 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -590,6 +590,7 @@ static int hci_dev_do_close(struct hci_dev *hdev) del_timer_sync(&hdev->cmd_timer); if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { + del_timer_sync(&hdev->cmd_timer); hci_req_unlock(hdev); return 0; } diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index c7eb073fe633..cb25628c0583 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2419,8 +2419,6 @@ static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *s if (!conn) goto unlock; - hci_conn_hold(conn); - conn->remote_cap = ev->capability; conn->remote_oob = ev->oob_data; conn->remote_auth = ev->authentication; diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index d47de2b04b2e..9e8dc136ef16 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1079,6 +1079,7 @@ static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq) tx_skb = skb_clone(skb, GFP_ATOMIC); bt_cb(skb)->retries++; control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE); + control &= L2CAP_CTRL_SAR; if (chan->conn_state & L2CAP_CONN_SEND_FBIT) { control |= L2CAP_CTRL_FINAL; diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 42fdffd1d76c..94954c74f6ae 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -369,6 +369,15 @@ static void __sco_sock_close(struct sock *sk) case BT_CONNECTED: case BT_CONFIG: + if (sco_pi(sk)->conn) { + sk->sk_state = BT_DISCONN; + sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT); + hci_conn_put(sco_pi(sk)->conn->hcon); + sco_pi(sk)->conn = NULL; + } else + sco_chan_del(sk, ECONNRESET); + break; + case BT_CONNECT: case BT_DISCONN: sco_chan_del(sk, ECONNRESET); |