Bluetooth: hci_sync: remove unnecessary hci_conn_get in create_conn_sync

hci_conn_get() without already held reference is data race against
concurrent deletion.

In previous patches, the refcount has been changed to be taken before
starting the hci_sync task, so remove these extra get() + put() as they
are not needed.

Fixes: 12917f591cea ("Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn()")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 10bc4c71509f4c4c16fe256bcf88bfbd136da694..c8d14128c363d7325ec16814fe3bc2f1ce294053 100644 (file)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -6741,11 +6741,6 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
 
        bt_dev_dbg(hdev, "conn %p", conn);
 
-       /* Hold a reference so conn stays valid for the HCI_CONN_CREATE
-        * clear_bit() at done.
-        */
-       hci_conn_get(conn);
-
        clear_bit(HCI_CONN_SCANNING, &conn->flags);
        conn->state = BT_CONNECT;
 
@@ -6760,7 +6755,6 @@ static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
                        conn->state = BT_OPEN;
                        hci_abort_conn_sync(hdev, conn,
                                            HCI_ERROR_REJ_LIMITED_RESOURCES);
-                       hci_conn_put(conn);
                        return -EBUSY;
                }
 
@@ -6858,7 +6852,6 @@ done:
 
        /* Re-enable advertising after the connection attempt is finished. */
        hci_resume_advertising_sync(hdev);
-       hci_conn_put(conn);
        return err;
 }
 
@@ -7133,11 +7126,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
        else
                cp.role_switch = 0x00;
 
-       /* Hold a reference so conn stays valid for the HCI_CONN_CREATE
-        * clear_bit() below.
-        */
-       hci_conn_get(conn);
-
        /* Mark create connection in flight so hci_cancel_connect_sync() can
         * cancel it while blocking on the connection complete event.
         */
@@ -7149,7 +7137,6 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
                                       conn->conn_timeout, NULL);
 
        clear_bit(HCI_CONN_CREATE, &conn->flags);
-       hci_conn_put(conn);
 
        return err;
 }