---

yaml
---
r: 246911
b: refs/heads/master
c: 820ffdb
h: refs/heads/master
i:
  246909: 4edc950
  246907: 916a455
  246903: 4e28a23
  246895: 650e67a
  246879: 374274b
  246847: 3fb6715
  246783: 817505d
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: baa7e1fa6d2870462bd744df1c6ddbd497fe86d6
+refs/heads/master: 820ffdb3d25f74fbd553453f461709d52dfa72a2

trunk/include/net/bluetooth/l2cap.h

@@ -309,11 +309,6 @@ struct l2cap_conn {
 	rwlock_t	chan_lock;
 };
 
-struct sock_del_list {
-	struct sock *sk;
-	struct list_head list;
-};
-
 #define L2CAP_INFO_CL_MTU_REQ_SENT	0x01
 #define L2CAP_INFO_FEAT_MASK_REQ_SENT	0x04
 #define L2CAP_INFO_FEAT_MASK_REQ_DONE	0x08

trunk/net/bluetooth/l2cap_core.c

@@ -487,16 +487,13 @@ void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err)
 /* ---- L2CAP connections ---- */
 static void l2cap_conn_start(struct l2cap_conn *conn)
 {
-	struct sock_del_list del, *tmp1, *tmp2;
-	struct l2cap_chan *chan;
+	struct l2cap_chan *chan, *tmp;
 
 	BT_DBG("conn %p", conn);
 
-	INIT_LIST_HEAD(&del.list);
-
 	read_lock(&conn->chan_lock);
 
-	list_for_each_entry(chan, &conn->chan_l, list) {
+	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
 		struct sock *sk = chan->sk;
 
 		bh_lock_sock(sk);
@@ -520,10 +517,11 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 					conn->feat_mask)
 					&& l2cap_pi(sk)->conf_state &
 					L2CAP_CONF_STATE2_DEVICE) {
-				tmp1 = kzalloc(sizeof(struct sock_del_list),
-						GFP_ATOMIC);
-				tmp1->sk = sk;
-				list_add_tail(&tmp1->list, &del.list);
+				/* __l2cap_sock_close() calls list_del(chan)
+				 * so release the lock */
+				read_unlock_bh(&conn->chan_lock);
+				 __l2cap_sock_close(sk, ECONNRESET);
+				read_lock_bh(&conn->chan_lock);
 				bh_unlock_sock(sk);
 				continue;
 			}
@@ -579,14 +577,6 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
 	}
 
 	read_unlock(&conn->chan_lock);
-
-	list_for_each_entry_safe(tmp1, tmp2, &del.list, list) {
-		bh_lock_sock(tmp1->sk);
-		__l2cap_sock_close(tmp1->sk, ECONNRESET);
-		bh_unlock_sock(tmp1->sk);
-		list_del(&tmp1->list);
-		kfree(tmp1);
-	}
 }
 
 /* Find socket with cid and source bdaddr.