Bluetooth: Call L2CAP teardown callback before clearing chan->conn

L2CAP channel implementations may want to still access the chan->conn
pointer. This will particularly be the case for SMP that will want to
clear a reference to the SMP channel in the l2cap_conn structure. The
only user of the teardown callback so far is l2cap_sock.c and for the
code there it makes no difference whether the callback is called before
or after clearing the chan->conn pointer.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 344a29c..c6419f4 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -566,6 +566,8 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
 
        BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
 
+       chan->ops->teardown(chan, err);
+
        if (conn) {
                struct amp_mgr *mgr = conn->hcon->amp_mgr;
                /* Delete from channel list */
@@ -589,8 +591,6 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
                amp_disconnect_logical_link(hs_hchan);
        }
 
-       chan->ops->teardown(chan, err);
-
        if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
                return;