Re: bluetooth: module_refcount is not decreased when connection times out

Hi Bing,

The module refcount is increased by hci_dev_hold() call in hci_conn_add() in hci_conn.c, and it is decreased by hci_dev_put() call in "del_conn" (hci_sysfs.c).

In case connection timeout happens, hci_dev_put() is never called.

Procedure to reproduce the issue:

# hciconfig hci0 up
# lsmod | grep btusb				-> "used by" refcount = 1

# hcitool cc <non-exisiting bdaddr>		-> will get timeout

# lsmod | grep btusb				-> "used by" refcount = 2
# hciconfig hci0 down
# lsmod | grep btusb				-> "used by" refcount = 1
# rmmod btusb					-> ERROR: Module btusb is in use

I have seen that happen before, but never had the time to check up on
them. Your analysis seems correct. Would have to check on how to fix
this. Proposals are welcome.

Regards

Marcel