projects / platform / kernel / linux-rpi.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 2394186) | patch
Bluetooth: L2CAP: Fix potential user-after-free
authorLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Wed, 1 Feb 2023 22:01:11 +0000 (14:01 -0800)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Thu, 9 Feb 2023 22:18:48 +0000 (14:18 -0800)
commitdf5703348813235874d851934e957c3723d71644
treeaa8217ebec403131c1524a365c6ac6e70fe71302tree | snapshot
parent2394186a2cefb9a45a029281a55749804dd8c556commit | diff
Bluetooth: L2CAP: Fix potential user-after-free

This fixes all instances of which requires to allocate a buffer calling
alloc_skb which may release the chan lock and reacquire later which
makes it possible that the chan is disconnected in the meantime.

Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending")
Reported-by: Alexander Coffin <alex.coffin@matician.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/l2cap_core.c diff | blob | history
net/bluetooth/l2cap_sock.c diff | blob | history
Domain: System / Kernel;