Bluetooth: ISO: handle bound CIS cleanup via hci_conn

Calling hci_conn_del in __iso_sock_close is invalid. It needs
hdev->lock, but it cannot be acquired there due to lock ordering.

Fix this by doing cleanup via hci_conn_drop.

Return hci_conn with refcount 1 from hci_bind_cis and hci_connect_cis,
so that the iso_conn always holds one reference.  This also fixes
refcounting when error handling.

Since hci_conn_abort shall handle termination of connections in any
state properly, we can handle BT_CONNECT socket state in the same way as
BT_CONNECTED.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index cccc2b8..923bb7e 100644 (file)
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1909,6 +1909,8 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst,
                return ERR_PTR(-EINVAL);
        }
 
+       hci_conn_hold(cis);
+
        cis->iso_qos = *qos;
        cis->state = BT_BOUND;
 
@@ -2262,6 +2264,9 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
                return ERR_PTR(-ENOLINK);
        }
 
+       /* Link takes the refcount */
+       hci_conn_drop(cis);
+
        cis->state = BT_CONNECT;
 
        hci_le_create_cis_pending(hdev);

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index cbe3299..358954b 100644 (file)
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -628,6 +628,7 @@ static void __iso_sock_close(struct sock *sk)
                iso_sock_cleanup_listen(sk);
                break;
 
+       case BT_CONNECT:
        case BT_CONNECTED:
        case BT_CONFIG:
                if (iso_pi(sk)->conn->hcon) {
@@ -645,19 +646,6 @@ static void __iso_sock_close(struct sock *sk)
        case BT_CONNECT2:
                iso_chan_del(sk, ECONNRESET);
                break;
-       case BT_CONNECT:
-               /* In case of DEFER_SETUP the hcon would be bound to CIG which
-                * needs to be removed so just call hci_conn_del so the cleanup
-                * callback do what is needed.
-                */
-               if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags) &&
-                   iso_pi(sk)->conn->hcon) {
-                       hci_conn_del(iso_pi(sk)->conn->hcon);
-                       iso_pi(sk)->conn->hcon = NULL;
-               }
-
-               iso_chan_del(sk, ECONNRESET);
-               break;
        case BT_DISCONN:
                iso_chan_del(sk, ECONNRESET);
                break;