Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 24d2b8c0 authored by Ulisses Furquim's avatar Ulisses Furquim Committed by Johan Hedberg
Browse files

Bluetooth: Fix possible use after free in delete path 



We need to use the _sync() version for cancelling the info and security
timer in the L2CAP connection delete path. Otherwise the delayed work
handler might run after the connection object is freed.

Signed-off-by: default avatarUlisses Furquim <ulisses@profusion.mobi>
Acked-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarJohan Hedberg <johan.hedberg@intel.com>
parent 6de32750

net/bluetooth/l2cap_core.c

+2 −2
Original line number Diff line number Diff line
@@ -1018,10 +1018,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) 
	hci_chan_del(conn->hchan);



	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)

		__cancel_delayed_work(&conn->info_timer);

		cancel_delayed_work_sync(&conn->info_timer);



	if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {

		__cancel_delayed_work(&conn->security_timer);

		cancel_delayed_work_sync(&conn->security_timer);

		smp_chan_destroy(conn);

	}