Bluetooth: L2CAP: Unref buffer after calling recv callback

This simplify the handling quite a bit while the application can still
prevent the buffer to be freed by referencing it if necessary.

Change-Id: I5ed0e96e8d9e349b79ba31ba9568af61181e1065
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

net/bluetooth/att.c

@@ -1478,7 +1478,7 @@ static void bt_att_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	if (buf->len < sizeof(*hdr)) {
 		BT_ERR("Too small ATT PDU received\n");
-		goto done;
+		return;
 	}
 
 	BT_DBG("Received ATT code 0x%02x len %u\n", hdr->code, buf->len);
@@ -1503,16 +1503,13 @@ static void bt_att_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	/* Commands don't have response */
 	if ((hdr->code & BT_ATT_OP_CMD_FLAG)) {
-		goto done;
+		return;
 	}
 
 	if (err) {
 		BT_DBG("ATT error 0x%02x", err);
 		send_err_rsp(chan->conn, hdr->code, 0, err);
 	}
-
-done:
-	net_buf_unref(buf);
 }
 
 static struct bt_att *att_chan_get(struct bt_conn *conn)

net/bluetooth/l2cap.c

@@ -532,7 +532,7 @@ static void l2cap_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	if (buf->len < sizeof(*hdr)) {
 		BT_ERR("Too small L2CAP LE signaling PDU\n");
-		goto drop;
+		return;
 	}
 
 	len = sys_le16_to_cpu(hdr->len);
@@ -543,12 +543,12 @@ static void l2cap_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	if (buf->len != len) {
 		BT_ERR("L2CAP length mismatch (%u != %u)\n", buf->len, len);
-		goto drop;
+		return;
 	}
 
 	if (!hdr->ident) {
 		BT_ERR("Invalid ident value in L2CAP PDU\n");
-		goto drop;
+		return;
 	}
 
 	switch (hdr->code) {
@@ -574,9 +574,6 @@ static void l2cap_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 				  BT_L2CAP_REJ_NOT_UNDERSTOOD);
 		break;
 	}
-
-drop:
-	net_buf_unref(buf);
 }
 
 static void l2cap_chan_update_credits(struct bt_l2cap_chan *chan)
@@ -622,7 +619,6 @@ static void l2cap_chan_le_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	if (!chan->rx.credits) {
 		BT_ERR("No credits to receive packet\n");
-		net_buf_unref(buf);
 		return;
 	}
 
@@ -637,7 +633,6 @@ static void l2cap_chan_le_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	if (sdu_len > chan->rx.mtu) {
 		BT_ERR("Invalid SDU length\n");
-		net_buf_unref(buf);
 		return;
 	}
 
@@ -688,6 +683,8 @@ void bt_l2cap_recv(struct bt_conn *conn, struct net_buf *buf)
 	}
 
 	l2cap_chan_recv(chan, buf);
+
+	net_buf_unref(buf);
 }
 
 int bt_l2cap_update_conn_param(struct bt_conn *conn)

net/bluetooth/smp.c

@@ -1408,7 +1408,7 @@ static void bt_smp_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 	if (buf->len < sizeof(*hdr)) {
 		BT_ERR("Too small SMP PDU received\n");
-		goto done;
+		return;
 	}
 
 	BT_DBG("Received SMP code 0x%02x len %u\n", hdr->code, buf->len);
@@ -1423,7 +1423,7 @@ static void bt_smp_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 	if (atomic_test_bit(&smp->flags, SMP_FLAG_TIMEOUT)) {
 		BT_WARN("SMP command (code 0x%02x) received after timeout\n",
 			hdr->code);
-		goto done;
+		return;
 	}
 
 	if (hdr->code >= ARRAY_SIZE(handlers) || !handlers[hdr->code].func) {
@@ -1432,7 +1432,7 @@ static void bt_smp_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 	} else {
 		if (!atomic_test_and_clear_bit(&smp->allowed_cmds, hdr->code)) {
 			BT_WARN("Unexpected SMP code 0x%02x\n", hdr->code);
-			goto done;
+			return;
 		}
 
 		if (buf->len != handlers[hdr->code].expect_len) {
@@ -1449,9 +1449,6 @@ static void bt_smp_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 
 		smp_reset(smp);
 	}
-
-done:
-	net_buf_unref(buf);
 }
 
 static void bt_smp_connected(struct bt_l2cap_chan *chan)

net/bluetooth/smp_null.c

@@ -45,8 +45,6 @@ static void bt_smp_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 	struct bt_smp_pairing_fail *rsp;
 	struct bt_smp_hdr *hdr;
 
-	net_buf_put(buf);
-
 	/* If a device does not support pairing then it shall respond with
 	 * a Pairing Failed command with the reason set to “Pairing Not
 	 * Supported” when any command is received.

samples/bluetooth/shell/src/main.c

@@ -1031,7 +1031,6 @@ static void cmd_auth_passkey(int argc, char *argv[])
 static void l2cap_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
 {
 	printk("Incoming data channel %p len %u\n", chan, buf->len);
-	net_buf_unref(buf);
 }
 
 static void l2cap_connected(struct bt_l2cap_chan *chan)