Fix dangling callout problem in the Bluetooth L2CAP code that leads to

panic. The panic happens when outgoing L2CAP connection descriptor is
deleted with the L2CAP command(s) pending in the queue. In this case when
the last L2CAP command is deleted (due to cleanup) and reference counter
for the L2CAP connection goes down to zero the auto disconnect timeout
is incorrectly set. pjd gets credit for tracking this down and committing
bandaid.

Reported by:	Jonatan B <onatan at gmail dot com>
MFC after:	3 days

3 files changed, 14 insertions, 5 deletions

diff --git a/sys/netgraph/bluetooth/include/ng_l2cap.h b/sys/netgraph/bluetooth/include/ng_l2cap.h
index 094aad3..f57b5cb 100644
--- a/sys/netgraph/bluetooth/include/ng_l2cap.h
+++ b/sys/netgraph/bluetooth/include/ng_l2cap.h
@@ -623,6 +623,7 @@ typedef struct {
 #define NG_L2CAP_CON_OUTGOING		(1 << 2) /* outgoing connection */
 #define NG_L2CAP_CON_LP_TIMO		(1 << 3) /* LP timeout */
 #define NG_L2CAP_CON_AUTO_DISCON_TIMO	(1 << 4) /* auto discon. timeout */
+#define NG_L2CAP_CON_DYING		(1 << 5) /* connection is dying */
 
 typedef struct {
 	u_int8_t	state;      /* connection state */
diff --git a/sys/netgraph/bluetooth/l2cap/ng_l2cap_cmds.c b/sys/netgraph/bluetooth/l2cap/ng_l2cap_cmds.c
index 06c19f6..2e0efe3 100644
--- a/sys/netgraph/bluetooth/l2cap/ng_l2cap_cmds.c
+++ b/sys/netgraph/bluetooth/l2cap/ng_l2cap_cmds.c
@@ -226,6 +226,9 @@ ng_l2cap_con_fail(ng_l2cap_con_p con, u_int16_t result)
 "%s: %s - ACL connection failed, result=%d\n",
 		__func__, NG_NODE_NAME(l2cap->node), result);
 
+	/* Connection is dying */
+	con->flags |= NG_L2CAP_CON_DYING;
+
 	/* Clean command queue */
 	while (!TAILQ_EMPTY(&con->cmd_list)) {
 		cmd = TAILQ_FIRST(&con->cmd_list);
diff --git a/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c b/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c
index 10eb89e..635298a 100644
--- a/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c
+++ b/sys/netgraph/bluetooth/l2cap/ng_l2cap_misc.c
@@ -182,12 +182,14 @@ ng_l2cap_con_unref(ng_l2cap_con_p con)
 	 * 2) connection is in OPEN state
 	 * 3) it is an outgoing connection
 	 * 4) disconnect timeout > 0
+	 * 5) connection is not dying
 	 */
 
 	if ((con->refcnt == 0) &&
 	    (con->state == NG_L2CAP_CON_OPEN) &&
 	    (con->flags & NG_L2CAP_CON_OUTGOING) && 
-	    (con->l2cap->discon_timo > 0))
+	    (con->l2cap->discon_timo > 0) &&
+	    ((con->flags & NG_L2CAP_CON_DYING) == 0))
 		ng_l2cap_discon_timeout(con);
 } /* ng_l2cap_con_unref */
 
@@ -273,11 +275,14 @@ ng_l2cap_free_con(ng_l2cap_con_p con)
 		ng_l2cap_free_cmd(cmd);
 	}
 
+	if (con->flags & (NG_L2CAP_CON_AUTO_DISCON_TIMO|NG_L2CAP_CON_LP_TIMO))
+		panic(
+"%s: %s - timeout pending! state=%d, flags=%#x\n",
+			__func__,  NG_NODE_NAME(con->l2cap->node),
+			con->state, con->flags);
+
 	LIST_REMOVE(con, next);
-	if (con->flags & NG_L2CAP_CON_AUTO_DISCON_TIMO)
-		ng_l2cap_discon_untimeout(con);
-	if (con->flags & NG_L2CAP_CON_LP_TIMO)
-		ng_l2cap_lp_untimeout(con);
+
 	bzero(con, sizeof(*con));
 	FREE(con, M_NETGRAPH_L2CAP);
 } /* ng_l2cap_free_con */