[PATCH 4/6] [BLUETOOTH]: l2cap info_timer delete fix in hci_conn_del

[Andres Salomon]

From: Dave Young <hidave.darkstar at gmail.com>

When the l2cap info_timer is active the info_state will be set to
L2CAP_INFO_FEAT_MASK_REQ_SENT, and it will be unset after the timer is
deleted or timeout triggered.

Here in l2cap_conn_del only call del_timer_sync when the info_state is
set to L2CAP_INFO_FEAT_MASK_REQ_SENT.

Signed-off-by: Dave Young <hidave.darkstar at gmail.com>
Acked-by: Marcel Holtmann <marcel at holtmann.org>
Signed-off-by: David S. Miller <davem at davemloft.net>
Signed-off-by: Andres Salomon <dilinger at canonical.com>
---
 net/bluetooth/l2cap.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index e165c9b..e4b5d62 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -426,7 +426,8 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 		l2cap_sock_kill(sk);
 	}
 
-	del_timer_sync(&conn->info_timer);
+	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
+		del_timer_sync(&conn->info_timer);
 
 	hcon->l2cap_data = NULL;
 	kfree(conn);
-- 
1.5.6.5