.. | .. |
---|
45 | 45 | static void l2cap_sock_init(struct sock *sk, struct sock *parent); |
---|
46 | 46 | static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, |
---|
47 | 47 | int proto, gfp_t prio, int kern); |
---|
| 48 | +static void l2cap_sock_cleanup_listen(struct sock *parent); |
---|
48 | 49 | |
---|
49 | 50 | bool l2cap_is_socket(struct socket *sock) |
---|
50 | 51 | { |
---|
.. | .. |
---|
1414 | 1415 | if (!sk) |
---|
1415 | 1416 | return 0; |
---|
1416 | 1417 | |
---|
| 1418 | + l2cap_sock_cleanup_listen(sk); |
---|
1417 | 1419 | bt_sock_unlink(&l2cap_sk_list, sk); |
---|
1418 | 1420 | |
---|
1419 | 1421 | err = l2cap_sock_shutdown(sock, SHUT_RDWR); |
---|
.. | .. |
---|
1623 | 1625 | if (!skb) |
---|
1624 | 1626 | return ERR_PTR(err); |
---|
1625 | 1627 | |
---|
| 1628 | + /* Channel lock is released before requesting new skb and then |
---|
| 1629 | + * reacquired thus we need to recheck channel state. |
---|
| 1630 | + */ |
---|
| 1631 | + if (chan->state != BT_CONNECTED) { |
---|
| 1632 | + kfree_skb(skb); |
---|
| 1633 | + return ERR_PTR(-ENOTCONN); |
---|
| 1634 | + } |
---|
| 1635 | + |
---|
1626 | 1636 | skb->priority = sk->sk_priority; |
---|
1627 | 1637 | |
---|
1628 | 1638 | bt_cb(skb)->l2cap.chan = chan; |
---|