3 files changed, 17 insertions, 19 deletions

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index d05d91f2fd32..ec56d8861a4e 100644
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -277,6 +277,11 @@ struct l2cap_conn_param_update_rsp {
 #define L2CAP_CONN_PARAM_REJECTED       0x0001
 
 /* ----- L2CAP channels and connections ----- */
+struct srej_list {
+        __u8    tx_seq;
+        struct list_head list;
+};
+
 struct l2cap_chan {
         struct sock *sk;
         __u8            ident;
@@ -312,6 +317,7 @@ struct l2cap_chan {
         struct sk_buff_head     srej_q;
         struct sk_buff_head     busy_q;
         struct work_struct      busy_work;
+        struct list_head        srej_l;
 
         struct list_head list;
 };
@@ -350,12 +356,6 @@ struct l2cap_conn {
 /* ----- L2CAP socket info ----- */
 #define l2cap_pi(sk) ((struct l2cap_pinfo *) sk)
 #define TX_QUEUE(sk) (&l2cap_pi(sk)->tx_queue)
-#define SREJ_LIST(sk) (&l2cap_pi(sk)->srej_l.list)
-
-struct srej_list {
-        __u8    tx_seq;
-        struct list_head list;
-};
 
 struct l2cap_pinfo {
         struct bt_sock  bt;
@@ -385,7 +385,6 @@ struct l2cap_pinfo {
         __le16          sport;
 
         struct sk_buff_head     tx_queue;
-        struct srej_list        srej_l;
         struct l2cap_conn       *conn;
         struct l2cap_chan       *chan;
 };
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7264119b64a6..9580d6cd55da 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -252,7 +252,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err)
                 skb_queue_purge(&chan->srej_q);
                 skb_queue_purge(&chan->busy_q);
 
-                list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
+                list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
                         list_del(&l->list);
                         kfree(l);
                 }
@@ -1205,7 +1205,7 @@ static void l2cap_send_srejtail(struct l2cap_chan *chan)
         control = L2CAP_SUPER_SELECT_REJECT;
         control |= L2CAP_CTRL_FINAL;
 
-        tail = list_entry(SREJ_LIST(chan->sk)->prev, struct srej_list, list);
+        tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
         control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
 
         l2cap_send_sframe(chan, control);
@@ -1596,6 +1596,8 @@ static inline void l2cap_ertm_init(struct l2cap_chan *chan)
         skb_queue_head_init(&chan->srej_q);
         skb_queue_head_init(&chan->busy_q);
 
+        INIT_LIST_HEAD(&chan->srej_l);
+
         INIT_WORK(&chan->busy_work, l2cap_busy_work);
 
         sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
@@ -3207,11 +3209,10 @@ static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq)
 
 static void l2cap_resend_srejframe(struct l2cap_chan *chan, u8 tx_seq)
 {
-        struct sock *sk = chan->sk;
         struct srej_list *l, *tmp;
         u16 control;
 
-        list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
+        list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
                 if (l->tx_seq == tx_seq) {
                         list_del(&l->list);
                         kfree(l);
@@ -3221,13 +3222,12 @@ static void l2cap_resend_srejframe(struct l2cap_chan *chan, u8 tx_seq)
                 control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
                 l2cap_send_sframe(chan, control);
                 list_del(&l->list);
-                list_add_tail(&l->list, SREJ_LIST(sk));
+                list_add_tail(&l->list, &chan->srej_l);
         }
 }
 
 static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
 {
-        struct sock *sk = chan->sk;
         struct srej_list *new;
         u16 control;
 
@@ -3239,7 +3239,7 @@ static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq)
                 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
                 new->tx_seq = chan->expected_tx_seq;
                 chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
-                list_add_tail(&new->list, SREJ_LIST(sk));
+                list_add_tail(&new->list, &chan->srej_l);
         }
         chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64;
 }
@@ -3288,7 +3288,7 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
         if (chan->conn_state & L2CAP_CONN_SREJ_SENT) {
                 struct srej_list *first;
 
-                first = list_first_entry(SREJ_LIST(sk),
+                first = list_first_entry(&chan->srej_l,
                                 struct srej_list, list);
                 if (tx_seq == first->tx_seq) {
                         l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
@@ -3297,7 +3297,7 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
                         list_del(&first->list);
                         kfree(first);
 
-                        if (list_empty(SREJ_LIST(sk))) {
+                        if (list_empty(&chan->srej_l)) {
                                 chan->buffer_seq = chan->buffer_seq_srej;
                                 chan->conn_state &= ~L2CAP_CONN_SREJ_SENT;
                                 l2cap_send_ack(chan);
@@ -3310,7 +3310,7 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
                         if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
                                 goto drop;
 
-                        list_for_each_entry(l, SREJ_LIST(sk), list) {
+                        list_for_each_entry(l, &chan->srej_l, list) {
                                 if (l->tx_seq == tx_seq) {
                                         l2cap_resend_srejframe(chan, tx_seq);
                                         return 0;
@@ -3332,7 +3332,7 @@ static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_cont
 
                 BT_DBG("sk %p, Enter SREJ", sk);
 
-                INIT_LIST_HEAD(SREJ_LIST(sk));
+                INIT_LIST_HEAD(&chan->srej_l);
                 chan->buffer_seq_srej = chan->buffer_seq;
 
                 __skb_queue_head_init(&chan->srej_q);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 55dee999af94..16a223bfa8f5 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1018,7 +1018,6 @@ void l2cap_sock_init(struct sock *sk, struct sock *parent)
         /* Default config options */
         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
         skb_queue_head_init(TX_QUEUE(sk));
-        INIT_LIST_HEAD(SREJ_LIST(sk));
 }
 
 static struct proto l2cap_proto = {