summaryrefslogtreecommitdiff
path: root/net/bluetooth
diff options
context:
space:
mode:
authorAndrei Emeltchenko <andrei.emeltchenko@intel.com>2012-10-15 11:58:44 +0300
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>2012-10-15 09:49:58 -0300
commit56f6098441adb9487f6e0439429fc536afcf9e71 (patch)
tree464c810ab1efb3f5ddf0a69f1a5556b55ad55b5d /net/bluetooth
parent79de886d9c40be1d82d414ccc5640268c705af39 (diff)
Bluetooth: Zero bredr pointer when chan is deleted
If BREDR L2CAP chan is deleted and this chan is the channel through which High Speed traffic is routed to AMP then zero pointer to the chan in amp_mgr to prevent accessing it. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/l2cap_core.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 603742fc17a7..f873619fdcfd 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -531,6 +531,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
if (conn) {
+ struct amp_mgr *mgr = conn->hcon->amp_mgr;
/* Delete from channel list */
list_del(&chan->list);
@@ -540,6 +541,9 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
hci_conn_put(conn->hcon);
+
+ if (mgr && mgr->bredr_chan == chan)
+ mgr->bredr_chan = NULL;
}
chan->ops->teardown(chan, err);