Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 56f60984 authored by Andrei Emeltchenko's avatar Andrei Emeltchenko Committed by Gustavo Padovan
Browse files

Bluetooth: Zero bredr pointer when chan is deleted 



If BREDR L2CAP chan is deleted and this chan is the channel through
which High Speed traffic is routed to AMP then zero pointer to
the chan in amp_mgr to prevent accessing it.

Signed-off-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
parent 79de886d

net/bluetooth/l2cap_core.c

+4 −0
Original line number Diff line number Diff line
@@ -531,6 +531,7 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) 
	BT_DBG("chan %p, conn %p, err %d", chan, conn, err);



	if (conn) {

		struct amp_mgr *mgr = conn->hcon->amp_mgr;

		/* Delete from channel list */

		list_del(&chan->list);
@@ -540,6 +541,9 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) 


		if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)

			hci_conn_put(conn->hcon);



		if (mgr && mgr->bredr_chan == chan)

			mgr->bredr_chan = NULL;

	}



	chan->ops->teardown(chan, err);