never schedule work for a dead connection

diff --git a/connection.c b/connection.c
index 32bb2e34d4f3c60179aef902683a9372734a152b..367e463d66712da41edc3f27039c0713a1fcb85b 100644 (file)
--- a/connection.c
+++ b/connection.c
@@ -1490,16 +1490,17 @@ int kdbus_conn_disconnect(struct kdbus_conn *conn, bool ensure_queue_empty)
                        continue;
                }
 
-               /*
-                * In asynchronous cases, send a 'connection
-                * dead' notification, mark entry as handled,
-                * and trigger the timeout handler.
-                */
+               /* send a 'connection dead' notification */
                kdbus_notify_reply_dead(conn->bus, reply->conn->id,
                                        reply->cookie);
 
-               reply->deadline_ns = 0;
-               schedule_delayed_work(&reply->conn->work, 0);
+               /* mark entry as handled, and trigger the timeout handler */
+               mutex_lock(&reply->conn->lock);
+               if (kdbus_conn_active(conn)) {
+                       reply->deadline_ns = 0;
+                       schedule_delayed_work(&reply->conn->work, 0);
+               }
+               mutex_unlock(&reply->conn->lock);
 
                list_del(&reply->entry);
                kdbus_conn_reply_free(reply);
@@ -1513,9 +1514,6 @@ int kdbus_conn_disconnect(struct kdbus_conn *conn, bool ensure_queue_empty)
 
        kdbus_notify_flush(conn->bus);
 
-       /* drop additional reference whe took at HELLO time */
-       kdbus_conn_unref(conn);
-
        return 0;
 }
 
@@ -2075,9 +2073,6 @@ int kdbus_conn_new(struct kdbus_ep *ep,
        list_add_tail(&conn->ep_entry, &ep->conn_list);
        hash_add(bus->conn_hash, &conn->hentry, conn->id);
 
-       /* take additional reference until we disconnect */
-       kdbus_conn_ref(conn);
-
        mutex_unlock(&ep->lock);
        mutex_unlock(&bus->lock);