Skip to content

Commit

Permalink
Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
Browse files Browse the repository at this point in the history 
The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  • Loading branch information
Luiz Augusto von Dentz authored and Marcel Holtmann committed Jun 26, 2021
1 parent 1fa20d7 commit de895b4
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions net/bluetooth/l2cap_core.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6066,7 +6066,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
struct l2cap_ecred_conn_rsp *rsp = (void *) data;
struct hci_conn *hcon = conn->hcon;
u16 mtu, mps, credits, result;
struct l2cap_chan *chan;
struct l2cap_chan *chan, *tmp;
int err = 0, sec_level;
int i = 0;

Expand All @@ -6085,7 +6085,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,

cmd_len -= sizeof(*rsp);

list_for_each_entry(chan, &conn->chan_l, list) {
list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
u16 dcid;

if (chan->ident != cmd->ident ||
Expand Down

0 comments on commit de895b4

Please sign in to comment.