Bluetooth: Fix using hci_conn_get() for hci_conn pointers

Wherever we keep hci_conn pointers around we should be using
hci_conn_get/put to ensure that they stay valid. This patch fixes
all places violating against the principle currently.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 2 insertions, 1 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d2ee162ecddb..e6a496ae0318 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4231,6 +4231,7 @@ static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 list_del_init(&params->action);
                 if (params->conn) {
                         hci_conn_drop(params->conn);
+                        hci_conn_put(params->conn);
                         params->conn = NULL;
                 }
         }
@@ -4322,7 +4323,7 @@ static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
                  * the parameters get removed and keep the reference
                  * count consistent once the connection is established.
                  */
-                params->conn = conn;
+                params->conn = hci_conn_get(conn);
                 return;
         }