summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/rfcomm/core.c25
1 files changed, 11 insertions, 14 deletions
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index c2486a53714e..41b3a0928419 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -666,6 +666,9 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
BT_DBG("session %p state %ld err %d", s, s->state, err);
+ if (s->state == BT_CLOSED)
+ return;
+
rfcomm_session_hold(s);
s->state = BT_CLOSED;
@@ -678,6 +681,12 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
}
rfcomm_session_clear_timer(s);
+
+ /* Drop reference for incoming sessions */
+ if (!s->initiator)
+ if (list_empty(&s->dlcs))
+ rfcomm_session_put(s);
+
rfcomm_session_put(s);
}
@@ -1158,12 +1167,7 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
break;
case BT_DISCONN:
- /* When socket is closed and we are not RFCOMM
- * initiator rfcomm_process_rx already calls
- * rfcomm_session_put() */
- if (s->sock->sk->sk_state != BT_CLOSED)
- if (list_empty(&s->dlcs))
- rfcomm_session_put(s);
+ rfcomm_session_close(s, 0);
break;
}
}
@@ -1194,7 +1198,6 @@ static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
else
err = ECONNRESET;
- s->state = BT_CLOSED;
rfcomm_session_close(s, err);
}
return 0;
@@ -1229,7 +1232,6 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
else
err = ECONNRESET;
- s->state = BT_CLOSED;
rfcomm_session_close(s, err);
}
@@ -1855,12 +1857,8 @@ static inline void rfcomm_process_rx(struct rfcomm_session *s)
rfcomm_recv_frame(s, skb);
}
- if (sk->sk_state == BT_CLOSED) {
- if (!s->initiator)
- rfcomm_session_put(s);
-
+ if (sk->sk_state == BT_CLOSED)
rfcomm_session_close(s, sk->sk_err);
- }
}
static inline void rfcomm_accept_connection(struct rfcomm_session *s)
@@ -1915,7 +1913,6 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
break;
case BT_CLOSED:
- s->state = BT_CLOSED;
rfcomm_session_close(s, sk->sk_err);
break;
}