Patch "Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-hci_conn-reduce-hci_conn_drop-calls-in-two.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 8312de9db3bbe5da4de70dbdbbdf812b9f251838
Author: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
Date:   Tue Oct 1 09:21:25 2024 +0200

    Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions
    
    [ Upstream commit d96b543c6f3b78b6440b68b5a5bbface553eff28 ]
    
    An hci_conn_drop() call was immediately used after a null pointer check
    for an hci_conn_link() call in two function implementations.
    Thus call such a function only once instead directly before the checks.
    
    This issue was transformed by using the Coccinelle software.
    
    Signed-off-by: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 6178ae8feafc..549ee9e87d63 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -2178,13 +2178,9 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst,
 					  conn->iso_qos.bcast.big);
 	if (parent && parent != conn) {
 		link = hci_conn_link(parent, conn);
-		if (!link) {
-			hci_conn_drop(conn);
-			return ERR_PTR(-ENOLINK);
-		}
-
-		/* Link takes the refcount */
 		hci_conn_drop(conn);
+		if (!link)
+			return ERR_PTR(-ENOLINK);
 	}
 
 	return conn;
@@ -2274,15 +2270,12 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev, bdaddr_t *dst,
 	}
 
 	link = hci_conn_link(le, cis);
+	hci_conn_drop(cis);
 	if (!link) {
 		hci_conn_drop(le);
-		hci_conn_drop(cis);
 		return ERR_PTR(-ENOLINK);
 	}
 
-	/* Link takes the refcount */
-	hci_conn_drop(cis);
-
 	cis->state = BT_CONNECT;
 
 	hci_le_create_cis_pending(hdev);