diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-06-01 17:54:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-06-01 17:54:55 +0200 |
| commit | d0acb5202d0e33d23cbe6994424587fbb05a5360 (patch) | |
| tree | 4b7fd07149896994fb739e1cbb5d65f2e47cd6d7 /net/bluetooth/rfcomm/sock.c | |
| parent | 55f3722fc694d6478eca3020b12a4d6a79b06f27 (diff) | |
| parent | bb532bfaf7919c7c98caab81864e9ce2646e11e3 (diff) | |
Merge v7.0.11linux-rolling-stable
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/bluetooth/rfcomm/sock.c')
| -rw-r--r-- | net/bluetooth/rfcomm/sock.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index be6639cd6f59..bd7d959c6e9e 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -180,6 +180,8 @@ static void rfcomm_sock_cleanup_listen(struct sock *parent) while ((sk = bt_accept_dequeue(parent, NULL))) { rfcomm_sock_close(sk); rfcomm_sock_kill(sk); + /* Drop the reference handed back by bt_accept_dequeue(). */ + sock_put(sk); } parent->sk_state = BT_CLOSED; @@ -497,8 +499,13 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, } nsk = bt_accept_dequeue(sk, newsock); - if (nsk) + if (nsk) { + /* Drop the bridging ref from bt_accept_dequeue(); + * the grafted socket keeps nsk alive from here. + */ + sock_put(nsk); break; + } if (!timeo) { err = -EAGAIN; |