Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c0242199 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Greg Kroah-Hartman
Browse files

Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} 



commit a2a9339e1c9deb7e1e079e12e27a0265aea8421a upstream.

Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

Cc: stable@kernel.org
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarMin Li <lm0963hack@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9025cea8

net/bluetooth/l2cap_core.c

+6 −18
Original line number Diff line number Diff line
@@ -4368,33 +4368,27 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, 


	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);



	mutex_lock(&conn->chan_lock);



	chan = __l2cap_get_chan_by_scid(conn, dcid);

	chan = l2cap_get_chan_by_scid(conn, dcid);

	if (!chan) {

		mutex_unlock(&conn->chan_lock);

		cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);

		return 0;

	}



	l2cap_chan_hold(chan);

	l2cap_chan_lock(chan);



	rsp.dcid = cpu_to_le16(chan->scid);

	rsp.scid = cpu_to_le16(chan->dcid);

	l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);



	chan->ops->set_shutdown(chan);



	mutex_lock(&conn->chan_lock);

	l2cap_chan_del(chan, ECONNRESET);

	mutex_unlock(&conn->chan_lock);



	chan->ops->close(chan);



	l2cap_chan_unlock(chan);

	l2cap_chan_put(chan);



	mutex_unlock(&conn->chan_lock);



	return 0;

}
@@ -4414,33 +4408,27 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, 


	BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);



	mutex_lock(&conn->chan_lock);



	chan = __l2cap_get_chan_by_scid(conn, scid);

	chan = l2cap_get_chan_by_scid(conn, scid);

	if (!chan) {

		mutex_unlock(&conn->chan_lock);

		return 0;

	}



	l2cap_chan_hold(chan);

	l2cap_chan_lock(chan);



	if (chan->state != BT_DISCONN) {

		l2cap_chan_unlock(chan);

		l2cap_chan_put(chan);

		mutex_unlock(&conn->chan_lock);

		return 0;

	}



	mutex_lock(&conn->chan_lock);

	l2cap_chan_del(chan, 0);

	mutex_unlock(&conn->chan_lock);



	chan->ops->close(chan);



	l2cap_chan_unlock(chan);

	l2cap_chan_put(chan);



	mutex_unlock(&conn->chan_lock);



	return 0;

}