Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Browse source

commit a2a9339e1c upstream.

Similar to commit d0be8347c6 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

Cc: stable@kernel.org
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Luiz Augusto von Dentz 2023-04-06 09:33:09 -07:00 • committed by Greg Kroah-Hartman

parent 71964e93fc

commit 348d446762

1 changed files with 6 additions and 18 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

24

net/bluetooth/l2cap_core.c

View file