[nrf noup] bluetooth: conn: Allow for an extra ref in bt_l2cap_send_pdu

Allow for an additional buffer reference if callback is provided. This
can be used to extend lifetime of the net buffer until the data
transmission is confirmed by ACK of the remote.

Signed-off-by: Marek Pieta <[email protected]>
(cherry picked from commit d6539f4)
(cherry picked from commit 685c53a)

Author: MarekPieta

subsys/bluetooth/host/conn.c

@@ -702,12 +702,19 @@ static int send_buf(struct bt_conn *conn, struct net_buf *buf,
 
 	uint16_t frag_len = MIN(conn_mtu(conn), len);
 
-	/* Check that buf->ref is 1 or 2. It would be 1 if this
-	 * was the only reference (e.g. buf was removed
-	 * from the conn tx_queue). It would be 2 if the
-	 * tx_data_pull kept it on the tx_queue for segmentation.
+	/* Check that buf->ref is 1 or 2. It would be 1 if this was
+	 * the only reference (e.g. buf was removed from the conn
+	 * tx_queue). It would be 2 if the tx_data_pull kept it on
+	 * the tx_queue for segmentation.
+	 *
+	 * Allow for an additional buffer reference if callback is
+	 * provided. This can be used to extend lifetime of the net
+	 * buffer until the data transmission is confirmed by ACK of
+	 * the remote.
 	 */
-	__ASSERT_NO_MSG((buf->ref == 1) || (buf->ref == 2));
+	if (buf->ref > 2 + (cb ? 1 : 0)) {
+		__ASSERT_NO_MSG(false);
+	}
 
 	/* The reference is always transferred to the frag, so when
 	 * the frag is destroyed, the parent reference is decremented.

subsys/bluetooth/host/l2cap.c

@@ -729,13 +729,17 @@ int bt_l2cap_send_pdu(struct bt_l2cap_le_chan *le_chan, struct net_buf *pdu,
 		return -ENOTCONN;
 	}
 
-	if (pdu->ref != 1) {
+	/* Allow for an additional buffer reference if callback is provided. This can be used to
+	 * extend lifetime of the net buffer until the data transmission is confirmed by ACK of the
+	 * remote.
+	 */
+	if (pdu->ref > 1 + (cb ? 1 : 0)) {
 		/* The host may alter the buf contents when fragmenting. Higher
 		 * layers cannot expect the buf contents to stay intact. Extra
 		 * refs suggests a silent data corruption would occur if not for
 		 * this error.
 		 */
-		LOG_ERR("Expecting 1 ref, got %d", pdu->ref);
+		LOG_ERR("Expecting up to %d refs, got %d", cb ? 2 : 1, pdu->ref);
 		return -EINVAL;
 	}