Bluetooth: Make better use of l2cap_chan reference counting
authorMat Martineau <mathewm@codeaurora.org>
Fri, 27 Apr 2012 23:50:50 +0000 (16:50 -0700)
committerGustavo Padovan <gustavo@padovan.org>
Wed, 9 May 2012 04:40:49 +0000 (01:40 -0300)
commit61d6ef3e3408cdf7e622646fb90a9f7f9560b943
treeb8a711d6cb948ec81749aa8b06a53a8e2dac0b37
parentdbd89fddc1f1fc96085deb164b7b9b2361241dd3
Bluetooth: Make better use of l2cap_chan reference counting

L2CAP sockets contain a pointer to l2cap_chan that needs to be
reference counted in order to prevent a possible dangling pointer when
the channel is freed.

There were a few other cases where an l2cap_chan pointer on the stack
was dereferenced after a call to l2cap_chan_del. Those pointers are
also now reference counted.

Signed-off-by: Mat Martineau <mathewm@codeaurora.org>
Signed-off-by: Gustavo Padovan <gustavo@padovan.org>
net/bluetooth/l2cap_core.c
net/bluetooth/l2cap_sock.c