Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Browse source

Similar to commit d0be8347c6 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

Cc: stable@kernel.org
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Min Li <lm0963hack@gmail.com>

...

This commit is contained in:

Luiz Augusto von Dentz 2023-04-06 09:33:09 -07:00

parent d2e4f1b1cb

commit a2a9339e1c

1 changed files with 6 additions and 18 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

24

net/bluetooth/l2cap_core.c

View file