xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails

Browse Source 
[ Upstream commit 1fa20d7d4aad02206e84b74915819fbe9f81dab3 ]

The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Luiz Augusto von Dentz
2021-05-19 13:41:50 -07:00
committed by Greg Kroah-Hartman
parent c4a9967e4d
commit 79a3130864
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
net/bluetooth/l2cap_core.c
View File

@@ -6237,7 +6237,7 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
struct l2cap_cmd_hdr *cmd, u16 cmd_len, struct l2cap_cmd_hdr *cmd, u16 cmd_len,
u8 *data) u8 *data)
{ {
struct l2cap_chan *chan; struct l2cap_chan *chan, *tmp;
struct l2cap_ecred_conn_rsp *rsp = (void *) data; struct l2cap_ecred_conn_rsp *rsp = (void *) data;
u16 result; u16 result;
@@ -6251,7 +6251,7 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
if (!result) if (!result)
return 0; return 0;
list_for_each_entry(chan, &conn->chan_l, list) { list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
if (chan->ident != cmd->ident) if (chan->ident != cmd->ident)
continue; continue;