Bluetooth: Drop rfcomm session reference only once for incoming session
Ville Tervo [Fri, 26 Feb 2010 10:21:01 +0000 (12:21 +0200)]
Move decision to drop reference for incoming session to
rfcomm_session_close to get more clear
rfcomm_session_hold()/rfcomm_session_put() pairs.

Rebase by: Jaikumar Ganesh <jaikumarg@android.com>

Signed-off-by: Ville Tervo <ville.tervo@nokia.com>
Signed-off-by: Jaikumar Ganesh <jaikumarg@android.com>
(cherry picked from commit dacd12646bbe15c98ab2b74b266092271a41d278)

Change-Id: I6b9374bb732d4f9706a65be19f8dbfddbe1de2df
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/75236
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
Reviewed-by: Rakesh Goyal <rgoyal@nvidia.com>

net/bluetooth/rfcomm/core.c

index c2486a5..41b3a09 100644 (file)
@@ -666,6 +666,9 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
 
        BT_DBG("session %p state %ld err %d", s, s->state, err);
 
+       if (s->state == BT_CLOSED)
+               return;
+
        rfcomm_session_hold(s);
 
        s->state = BT_CLOSED;
@@ -678,6 +681,12 @@ static void rfcomm_session_close(struct rfcomm_session *s, int err)
        }
 
        rfcomm_session_clear_timer(s);
+
+       /* Drop reference for incoming sessions */
+       if (!s->initiator)
+               if (list_empty(&s->dlcs))
+                       rfcomm_session_put(s);
+
        rfcomm_session_put(s);
 }
 
@@ -1158,12 +1167,7 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
                        break;
 
                case BT_DISCONN:
-                       /* When socket is closed and we are not RFCOMM
-                        * initiator rfcomm_process_rx already calls
-                        * rfcomm_session_put() */
-                       if (s->sock->sk->sk_state != BT_CLOSED)
-                               if (list_empty(&s->dlcs))
-                                       rfcomm_session_put(s);
+                       rfcomm_session_close(s, 0);
                        break;
                }
        }
@@ -1194,7 +1198,6 @@ static int rfcomm_recv_dm(struct rfcomm_session *s, u8 dlci)
                else
                        err = ECONNRESET;
 
-               s->state = BT_CLOSED;
                rfcomm_session_close(s, err);
        }
        return 0;
@@ -1229,7 +1232,6 @@ static int rfcomm_recv_disc(struct rfcomm_session *s, u8 dlci)
                else
                        err = ECONNRESET;
 
-               s->state = BT_CLOSED;
                rfcomm_session_close(s, err);
        }
 
@@ -1855,12 +1857,8 @@ static inline void rfcomm_process_rx(struct rfcomm_session *s)
                rfcomm_recv_frame(s, skb);
        }
 
-       if (sk->sk_state == BT_CLOSED) {
-               if (!s->initiator)
-                       rfcomm_session_put(s);
-
+       if (sk->sk_state == BT_CLOSED)
                rfcomm_session_close(s, sk->sk_err);
-       }
 }
 
 static inline void rfcomm_accept_connection(struct rfcomm_session *s)
@@ -1915,7 +1913,6 @@ static inline void rfcomm_check_connection(struct rfcomm_session *s)
                break;
 
        case BT_CLOSED:
-               s->state = BT_CLOSED;
                rfcomm_session_close(s, sk->sk_err);
                break;
        }