Bluetooth: Drop L2CAP chan reference if ERTM ack_timer fired
Reference counter was incremented when starting ack timer but
decremented only when clearing timer, not when timer fired.
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 778ceb2..6773453 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1996,6 +1996,8 @@
lock_sock(chan->sk);
__l2cap_send_ack(chan);
release_sock(chan->sk);
+
+ l2cap_chan_put(chan);
}
static inline void l2cap_ertm_init(struct l2cap_chan *chan)