Bluetooth: 6lowpan: add missing l2cap_chan_lock()

l2cap_chan_close() needs to be called in l2cap_chan_lock(), otherwise
l2cap_le_sig_cmd() etc. may run concurrently.

Add missing locks around l2cap_chan_close().

Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 588d7e94e6069de463da7eb1ae0e9786cb30a8a8..2c21ae8abadc2254a58d804696bd6fa3d2c8605b 100644 (file)
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -927,7 +927,9 @@ static int bt_6lowpan_disconnect(struct l2cap_conn *conn, u8 dst_type)
 
        BT_DBG("peer %p chan %p", peer, peer->chan);
 
+       l2cap_chan_lock(peer->chan);
        l2cap_chan_close(peer->chan, ENOENT);
+       l2cap_chan_unlock(peer->chan);
 
        return 0;
 }
@@ -1089,7 +1091,9 @@ static void do_enable_set(struct work_struct *work)
 
        mutex_lock(&set_lock);
        if (listen_chan) {
+               l2cap_chan_lock(listen_chan);
                l2cap_chan_close(listen_chan, 0);
+               l2cap_chan_unlock(listen_chan);
                l2cap_chan_put(listen_chan);
        }
 
@@ -1148,7 +1152,9 @@ static ssize_t lowpan_control_write(struct file *fp,
 
                mutex_lock(&set_lock);
                if (listen_chan) {
+                       l2cap_chan_lock(listen_chan);
                        l2cap_chan_close(listen_chan, 0);
+                       l2cap_chan_unlock(listen_chan);
                        l2cap_chan_put(listen_chan);
                        listen_chan = NULL;
                }
@@ -1310,7 +1316,9 @@ static void __exit bt_6lowpan_exit(void)
        debugfs_remove(lowpan_control_debugfs);
 
        if (listen_chan) {
+               l2cap_chan_lock(listen_chan);
                l2cap_chan_close(listen_chan, 0);
+               l2cap_chan_unlock(listen_chan);
                l2cap_chan_put(listen_chan);
        }