Bluetooth: L2CAP: Fix unrefing buffers that are queued

Vudentz · jhedberg · commit 42c5b0a7fafa · 2019-11-29T15:19:08.000+02:00
Processing of data received on dynamic channels is still done via syswq
so the buffer shall not be unrefed when they are queued.

Signed-off-by: Luiz Augusto von Dentz &lt;luiz.von.dentz@intel.com&gt;
diff --git a/subsys/bluetooth/host/l2cap.c b/subsys/bluetooth/host/l2cap.c
@@ -1676,6 +1676,7 @@ static void l2cap_chan_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 	BT_DBG("chan %p len %u", chan, buf->len);
 
 	chan->ops->recv(chan, buf);
+	net_buf_unref(buf);
 }
 
 void bt_l2cap_recv(struct bt_conn *conn, struct net_buf *buf)
@@ -1709,7 +1710,6 @@ void bt_l2cap_recv(struct bt_conn *conn, struct net_buf *buf)
 	}
 
 	l2cap_chan_recv(chan, buf);
-	net_buf_unref(buf);
 }
 
 int bt_l2cap_update_conn_param(struct bt_conn *conn,

Original file line number	Diff line number	Diff line change
`@@ -1676,6 +1676,7 @@ static void l2cap_chan_recv(struct bt_l2cap_chan chan, struct net_buf buf)`
`1676`	`1676`	`BT_DBG("chan %p len %u", chan, buf->len);`
`1677`	`1677`
`1678`	`1678`	`chan->ops->recv(chan, buf);`
	`1679`	`+ net_buf_unref(buf);`
`1679`	`1680`	`}`
`1680`	`1681`
`1681`	`1682`	`void bt_l2cap_recv(struct bt_conn conn, struct net_buf buf)`
`@@ -1709,7 +1710,6 @@ void bt_l2cap_recv(struct bt_conn conn, struct net_buf buf)`
`1709`	`1710`	`}`
`1710`	`1711`
`1711`	`1712`	`l2cap_chan_recv(chan, buf);`
`1712`		`- net_buf_unref(buf);`
`1713`	`1713`	`}`
`1714`	`1714`
`1715`	`1715`	`int bt_l2cap_update_conn_param(struct bt_conn *conn,`