net: bluetooth: prevent multiple l2cap_chan_destroy calls
Nagarjuna Kristam [Tue, 19 Jun 2012 07:23:06 +0000 (12:23 +0530)]
During l2cap channel disconnection, l2cap_chan_destroy is called twice,
when socket is released and when l2cap channel is closed. This causes
kernel panic.

add SOCK_DEAD check inside l2cap_sock_kill to prevent multiple
l2cap_chan_destroy function call

bug 1002888
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>

Change-Id: I1997ebe21351c034636f7133577a454a9e7bcedf
Reviewed-on: http://git-master/r/109731
Tested-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Rakesh Kumar <krakesh@nvidia.com>
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

Rebase-Id: Ra823d6000bb09141e129df3366b05dc36a54b5b5

net/bluetooth/l2cap_sock.c

index 36fed40..457cfe3 100644 (file)
@@ -844,7 +844,8 @@ done:
  */
 static void l2cap_sock_kill(struct sock *sk)
 {
-       if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
+       if (!sock_flag(sk, SOCK_ZAPPED) || sock_flag(sk, SOCK_DEAD) ||
+                               sk->sk_socket)
                return;
 
        BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));