diff options
| author | Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com> | 2021-08-10 12:14:08 +0800 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2021-08-10 10:40:48 -0700 |
| commit | 3f2c89fb465f63fe14da804a8afcd7ac6776508e (patch) | |
| tree | 77f90cabe318488ff0270b3ab87d7961d19de7a1 /net/bluetooth | |
| parent | 27c24fda62b601d6f9ca5e992502578c4310876f (diff) | |
Bluetooth: serialize calls to sco_sock_{set,clear}_timer
Currently, calls to sco_sock_set_timer are made under the locked
socket, but this does not apply to all calls to sco_sock_clear_timer.
Both sco_sock_{set,clear}_timer should be serialized by lock_sock to
prevent unexpected concurrent clearing/setting of timers.
Additionally, since sco_pi(sk)->conn is only cleared under the locked
socket, this change allows us to avoid races between
sco_sock_clear_timer and the call to kfree(conn) in sco_conn_del.
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/sco.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 68b51e321e82..77490338f4fa 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -453,8 +453,8 @@ static void __sco_sock_close(struct sock *sk) /* Must be called on unlocked socket. */ static void sco_sock_close(struct sock *sk) { - sco_sock_clear_timer(sk); lock_sock(sk); + sco_sock_clear_timer(sk); __sco_sock_close(sk); release_sock(sk); sco_sock_kill(sk); @@ -1104,8 +1104,8 @@ static void sco_conn_ready(struct sco_conn *conn) BT_DBG("conn %p", conn); if (sk) { - sco_sock_clear_timer(sk); lock_sock(sk); + sco_sock_clear_timer(sk); sk->sk_state = BT_CONNECTED; sk->sk_state_change(sk); release_sock(sk); |