1 files changed, 61 insertions, 0 deletions

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index db787f67c52a..3f5946351fb9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -872,6 +872,25 @@ static int l2cap_sock_release(struct socket *sock)
         return err;
 }
 
+static void l2cap_sock_cleanup_listen(struct sock *parent)
+{
+        struct sock *sk;
+
+        BT_DBG("parent %p", parent);
+
+        /* Close not yet accepted channels */
+        while ((sk = bt_accept_dequeue(parent, NULL))) {
+                struct l2cap_chan *chan = l2cap_pi(sk)->chan;
+
+                l2cap_chan_lock(chan);
+                __clear_chan_timer(chan);
+                l2cap_chan_close(chan, ECONNRESET);
+                l2cap_chan_unlock(chan);
+
+                l2cap_sock_kill(sk);
+        }
+}
+
 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
 {
         struct sock *sk, *parent = chan->data;
@@ -931,6 +950,47 @@ static void l2cap_sock_close_cb(struct l2cap_chan *chan)
         l2cap_sock_kill(sk);
 }
 
+static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
+{
+        struct sock *sk = chan->data;
+        struct sock *parent;
+
+        lock_sock(sk);
+
+        parent = bt_sk(sk)->parent;
+
+        sock_set_flag(sk, SOCK_ZAPPED);
+
+        switch (chan->state) {
+        case BT_OPEN:
+        case BT_BOUND:
+        case BT_CLOSED:
+                break;
+        case BT_LISTEN:
+                l2cap_sock_cleanup_listen(sk);
+                sk->sk_state = BT_CLOSED;
+                chan->state = BT_CLOSED;
+
+                break;
+        default:
+                sk->sk_state = BT_CLOSED;
+                chan->state = BT_CLOSED;
+
+                sk->sk_err = err;
+
+                if (parent) {
+                        bt_accept_unlink(sk);
+                        parent->sk_data_ready(parent, 0);
+                } else {
+                        sk->sk_state_change(sk);
+                }
+
+                break;
+        }
+
+        release_sock(sk);
+}
+
 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state)
 {
         struct sock *sk = chan->data;
@@ -959,6 +1019,7 @@ static struct l2cap_ops l2cap_chan_ops = {
         .new_connection = l2cap_sock_new_connection_cb,
         .recv           = l2cap_sock_recv_cb,
         .close          = l2cap_sock_close_cb,
+        .teardown       = l2cap_sock_teardown_cb,
         .state_change   = l2cap_sock_state_change_cb,
         .alloc_skb      = l2cap_sock_alloc_skb_cb,
 };