Bluetooth: Remove usage of __cancel_delayed_work()

__cancel_delayed_work() is being used in some paths where we cannot
sleep waiting for the delayed work to finish. However, that function
might return while the timer is running and the work will be queued
again. Replace the calls with safer cancel_delayed_work() version
which spins until the timer handler finishes on other CPUs and
cancels the delayed work.

Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 26486e182f550cf876e89fafe4b1b553dcc7dcdd..b1664ed884e68c461088217b9d97915e519592f0 100644 (file)
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -611,7 +611,7 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 {
        BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
 
-       if (!__cancel_delayed_work(work))
+       if (!cancel_delayed_work(work))
                l2cap_chan_hold(chan);
        schedule_delayed_work(work, timeout);
 }
@@ -619,7 +619,7 @@ static inline void l2cap_set_timer(struct l2cap_chan *chan,
 static inline void l2cap_clear_timer(struct l2cap_chan *chan,
                                        struct delayed_work *work)
 {
-       if (__cancel_delayed_work(work))
+       if (cancel_delayed_work(work))
                l2cap_chan_put(chan);
 }
 

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index dcccae04ae086767c793b269fbcc7c0280a484b3..ec10c698b891f3b712b7ba2872638614a20ca910 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2574,7 +2574,7 @@ static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hd
 
        if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
                                        cmd->ident == conn->info_ident) {
-               __cancel_delayed_work(&conn->info_timer);
+               cancel_delayed_work(&conn->info_timer);
 
                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
                conn->info_ident = 0;
@@ -3121,7 +3121,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cm
                        conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
                return 0;
 
-       __cancel_delayed_work(&conn->info_timer);
+       cancel_delayed_work(&conn->info_timer);
 
        if (result != L2CAP_IR_SUCCESS) {
                conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
@@ -4501,7 +4501,7 @@ int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
 
        if (hcon->type == LE_LINK) {
                smp_distribute_keys(conn, 0);
-               __cancel_delayed_work(&conn->security_timer);
+               cancel_delayed_work(&conn->security_timer);
        }
 
        rcu_read_lock();