Bluetooth: hci_core: Fix LE quote calculation

[ Upstream commit 932021a11805b9da4bd6abf66fe233cccd59fe0e ]

Function hci_sched_le needs to update the respective counter variable
inplace other the likes of hci_quote_sent would attempt to use the
possible outdated value of conn->{le_cnt,acl_cnt}.

Link: https://github.com/bluez/bluez/issues/915
Fixes: 73d80deb7bdf ("Bluetooth: prioritizing data over HCI")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 6ecb110bf46bc2efb204c82fae8413bbc5e147c3..b488d0742c966a7ee26022faeed6ce9ed92949ef 100644 (file)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3674,19 +3674,19 @@ static void hci_sched_le(struct hci_dev *hdev)
 {
        struct hci_chan *chan;
        struct sk_buff *skb;
-       int quote, cnt, tmp;
+       int quote, *cnt, tmp;
 
        BT_DBG("%s", hdev->name);
 
        if (!hci_conn_num(hdev, LE_LINK))
                return;
 
-       cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
+       cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
 
-       __check_timeout(hdev, cnt, LE_LINK);
+       __check_timeout(hdev, *cnt, LE_LINK);
 
-       tmp = cnt;
-       while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
+       tmp = *cnt;
+       while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
                u32 priority = (skb_peek(&chan->data_q))->priority;
                while (quote-- && (skb = skb_peek(&chan->data_q))) {
                        BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
@@ -3701,7 +3701,7 @@ static void hci_sched_le(struct hci_dev *hdev)
                        hci_send_frame(hdev, skb);
                        hdev->le_last_tx = jiffies;
 
-                       cnt--;
+                       (*cnt)--;
                        chan->sent++;
                        chan->conn->sent++;
 
@@ -3711,12 +3711,7 @@ static void hci_sched_le(struct hci_dev *hdev)
                }
        }
 
-       if (hdev->le_pkts)
-               hdev->le_cnt = cnt;
-       else
-               hdev->acl_cnt = cnt;
-
-       if (cnt != tmp)
+       if (*cnt != tmp)
                hci_prio_recalculate(hdev, LE_LINK);
 }