Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Johan Hedberg says:

====================
pull request: bluetooth 2015-07-02

A couple of regressions crept in because of a patch to use proper list
APIs rather than manually reading & writing the next/prev pointers
(commit 835a6a2f8603237a3e6cded5a6765090ecb06ea5). Turns out this was
masking a few bugs: a missing INIT_LIST_HEAD() call and incorrectly
using list_del() rather than list_del_init(). The two patches in this
set fix these, and it'd be nice they could still make it to 4.2-rc1 to
avoid new bug reports from users.

Please let me know if there are any issues pulling. Thanks.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 3 insertions, 2 deletions

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 9070dfd6b4ad..f1a117f8cad2 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -915,6 +915,7 @@ static int hidp_session_new(struct hidp_session **out, const bdaddr_t *bdaddr,
         session->conn = l2cap_conn_get(conn);
         session->user.probe = hidp_session_probe;
         session->user.remove = hidp_session_remove;
+        INIT_LIST_HEAD(&session->user.list);
         session->ctrl_sock = ctrl_sock;
         session->intr_sock = intr_sock;
         skb_queue_head_init(&session->ctrl_transmit);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 51594fb7b9e7..45fffa413642 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1634,7 +1634,7 @@ void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
         if (list_empty(&user->list))
                 goto out_unlock;
 
-        list_del(&user->list);
+        list_del_init(&user->list);
         user->remove(conn, user);
 
 out_unlock:
@@ -1648,7 +1648,7 @@ static void l2cap_unregister_all_users(struct l2cap_conn *conn)
 
         while (!list_empty(&conn->users)) {
                 user = list_first_entry(&conn->users, struct l2cap_user, list);
-                list_del(&user->list);
+                list_del_init(&user->list);
                 user->remove(conn, user);
         }
 }