Bluetooth: Fix hci_conn reference counting for fixed channels

Now that SMP has been converted to use fixed channels we've got a bit of
a problem with the hci_conn reference counting. So far the L2CAP code
has kept a reference for each L2CAP channel that was notified of the
connection. With SMP however this would mean that the connection is
never dropped even though there are no other users of it. Furthermore,
SMP already does its own hci_conn reference counting internally,
starting from a security or pairing request and ending with the key
distribution.

This patch makes L2CAP fixed channels default to the L2CAP core not
keeping a hci_conn reference for them. A new FLAG_HOLD_HCI_CONN flag is
added so that L2CAP users can declare an exception to this rule and hold
a reference even for their fixed channels. One such exception is the
L2CAP socket layer which does want a reference for each socket (e.g. an
ATT socket which uses a fixed channel).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index cedda399f9c0e7fb98ca62a1612e65f35e9a68b4..1558eccb19db769e204d3e6e716ca4e1ba201f7d 100644 (file)
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -711,6 +711,7 @@ enum {
        FLAG_DEFER_SETUP,
        FLAG_LE_CONN_REQ_SENT,
        FLAG_PENDING_SECURITY,
+       FLAG_HOLD_HCI_CONN,
 };
 
 enum {

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 777c41dbfdbe0b38e5c5a97bcf4ac0046570bbd8..a6559225bb500025509f5fd1d557b72ac0cefdf0 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -546,7 +546,10 @@ void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
 
        l2cap_chan_hold(chan);
 
-       hci_conn_hold(conn->hcon);
+       /* Only keep a reference for fixed channels if they requested it */
+       if (chan->chan_type != L2CAP_CHAN_FIXED ||
+           test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
+               hci_conn_hold(conn->hcon);
 
        list_add(&chan->list, &conn->chan_l);
 }
@@ -577,7 +580,12 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
                chan->conn = NULL;
 
-               if (chan->scid != L2CAP_CID_A2MP)
+               /* Reference was only held for non-fixed channels or
+                * fixed channels that explicitly requested it using the
+                * FLAG_HOLD_HCI_CONN flag.
+                */
+               if (chan->chan_type != L2CAP_CHAN_FIXED ||
+                   test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
                        hci_conn_drop(conn->hcon);
 
                if (mgr && mgr->bredr_chan == chan)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index ed06f88e6f10955cae33d31a3e348b25d2c647f9..31f106e61ca20fd15420830e653f81e7b1f87a20 100644 (file)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -146,6 +146,14 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
        case L2CAP_CHAN_RAW:
                chan->sec_level = BT_SECURITY_SDP;
                break;
+       case L2CAP_CHAN_FIXED:
+               /* Fixed channels default to the L2CAP core not holding a
+                * hci_conn reference for them. For fixed channels mapping to
+                * L2CAP sockets we do want to hold a reference so set the
+                * appropriate flag to request it.
+                */
+               set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
+               break;
        }
 
        bacpy(&chan->src, &la.l2_bdaddr);