Bluetooth: Release module reference counts
In three places a reference was taken without being returned.
Change-Id: I15b9ab7de530a77832d8b10fe756cfdf0b01760f
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
index af8ee26..b018a88 100644
--- a/net/bluetooth/amp.c
+++ b/net/bluetooth/amp.c
@@ -510,14 +510,14 @@
int result = -EINVAL;
BT_DBG("lcon %p", lcon);
- mgr = get_create_amp_mgr(lcon, NULL);
- if (!mgr)
- goto ap_finished;
- BT_DBG("mgr %p", mgr);
hdev = hci_dev_get(A2MP_HCI_ID(id));
if (!hdev)
goto ap_finished;
BT_DBG("hdev %p", hdev);
+ mgr = get_create_amp_mgr(lcon, NULL);
+ if (!mgr)
+ goto ap_finished;
+ BT_DBG("mgr %p", mgr);
conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK,
&mgr->l2cap_conn->hcon->dst);
if (conn) {
@@ -534,6 +534,8 @@
return;
ap_finished:
+ if (hdev)
+ hci_dev_put(hdev);
l2cap_amp_physical_complete(result, id, remote_id, sk);
}
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index abc3ef7..84bb9ef 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3165,14 +3165,16 @@
BT_DBG("hdev %s", hdev->name);
hcon = hci_conn_hash_lookup_ba(hdev, ACL_LINK, pi->conn->dst);
- if (!hcon)
- return NULL;
+ if (!hcon) {
+ chan = NULL;
+ goto done;
+ }
chan = hci_chan_list_lookup_id(hdev, hcon->handle);
if (chan) {
l2cap_aggregate(chan, pi);
hci_chan_hold(chan);
- return chan;
+ goto done;
}
if (bt_sk(pi)->parent) {
@@ -3186,6 +3188,8 @@
(struct hci_ext_fs *) &pi->local_fs,
(struct hci_ext_fs *) &pi->remote_fs);
}
+done:
+ hci_dev_put(hdev);
return chan;
}
@@ -4813,6 +4817,7 @@
result = L2CAP_MOVE_CHAN_REFUSED_CONTROLLER;
goto send_move_response;
}
+ hci_dev_put(hdev);
}
if (((pi->amp_move_state != L2CAP_AMP_STATE_STABLE &&