| Message ID | 20230914211133.3339473-1-luiz.dentz@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v3] Bluetooth: L2CAP: Fix leaking l2cap_conn objects | expand |
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=784344
---Test result---
Test Summary:
CheckPatch FAIL 1.36 seconds
GitLint PASS 0.38 seconds
SubjectPrefix PASS 0.14 seconds
BuildKernel PASS 34.64 seconds
CheckAllWarning PASS 38.21 seconds
CheckSparse PASS 46.51 seconds
CheckSmatch PASS 117.13 seconds
BuildKernel32 PASS 33.76 seconds
TestRunnerSetup PASS 518.75 seconds
TestRunner_l2cap-tester PASS 30.61 seconds
TestRunner_iso-tester PASS 58.41 seconds
TestRunner_bnep-tester PASS 10.75 seconds
TestRunner_mgmt-tester PASS 226.15 seconds
TestRunner_rfcomm-tester PASS 16.41 seconds
TestRunner_sco-tester PASS 19.73 seconds
TestRunner_ioctl-tester PASS 18.39 seconds
TestRunner_mesh-tester PASS 13.67 seconds
TestRunner_smp-tester PASS 14.52 seconds
TestRunner_userchan-tester PASS 11.31 seconds
IncrementalBuild PASS 32.15 seconds
Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v3] Bluetooth: L2CAP: Fix leaking l2cap_conn objects
WARNING: Reported-by: should be immediately followed by Closes: with a URL to the report
#88:
Reported-by: Olivier L'Heureux <olivier.lheureux@fortrobotics.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
total: 0 errors, 1 warnings, 0 checks, 88 lines checked
NOTE: For some of the reported defects, checkpatch may be able to
mechanically convert to the typical style using --fix or --fix-inplace.
/github/workspace/src/src/13386062.patch has style problems, please review.
NOTE: Ignored message types: UNKNOWN_COMMIT_ID
NOTE: If any of the errors are false positives, please report
them to the maintainer, see CHECKPATCH in MAINTAINERS.
---
Regards,
Linux Bluetooth
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index bbad301f5781..21459c38a074 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -795,6 +795,8 @@ struct hci_chan { unsigned int sent; __u8 state; bool amp; + + void (*cleanup)(struct hci_chan *chan); }; struct hci_conn_params { diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index e62a5f368a51..c4e16e92446c 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -2735,9 +2735,11 @@ struct hci_chan *hci_chan_create(struct hci_conn *conn) void hci_chan_del(struct hci_chan *chan) { struct hci_conn *conn = chan->conn; - struct hci_dev *hdev = conn->hdev; - BT_DBG("%s hcon %p chan %p", hdev->name, conn, chan); + if (!conn) + return; + + bt_dev_dbg(conn->hdev, "hcon %p chan %p", conn, chan); list_del_rcu(&chan->list); @@ -2746,6 +2748,10 @@ void hci_chan_del(struct hci_chan *chan) /* Prevent new hci_chan's to be created for this hci_conn */ set_bit(HCI_CONN_DROP, &conn->flags); + if (chan->cleanup) + chan->cleanup(chan); + + chan->conn = NULL; hci_conn_put(conn); skb_queue_purge(&chan->data_q); diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 17ca13e8c044..a791f28ccd6a 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1896,6 +1896,8 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); + hcon->l2cap_data = NULL; + kfree_skb(conn->rx_skb); skb_queue_purge(&conn->pending_rx); @@ -1931,13 +1933,15 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) mutex_unlock(&conn->chan_lock); - hci_chan_del(conn->hchan); + if (conn->hchan) { + conn->hchan->cleanup = NULL; + hci_chan_del(conn->hchan); + conn->hchan = NULL; + } if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); - hcon->l2cap_data = NULL; - conn->hchan = NULL; l2cap_conn_put(conn); } @@ -7830,6 +7834,24 @@ static void process_pending_rx(struct work_struct *work) l2cap_recv_frame(conn, skb); } +static void l2cap_conn_hchan_cleanup(struct hci_chan *hchan) +{ + struct hci_conn *hcon = hchan->conn; + struct l2cap_conn *conn; + + if (!hcon) + return; + + conn = hcon->l2cap_data; + if (!conn) + return; + + /* hci_chan_del has been called so we shouldn't call it gain. */ + conn->hchan = NULL; + + l2cap_conn_del(hcon, bt_to_errno(HCI_ERROR_LOCAL_HOST_TERM)); +} + static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) { struct l2cap_conn *conn = hcon->l2cap_data; @@ -7852,6 +7874,7 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) hcon->l2cap_data = conn; conn->hcon = hci_conn_get(hcon); conn->hchan = hchan; + hchan->cleanup = l2cap_conn_hchan_cleanup; BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);