diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2021-05-19 13:41:51 -0700 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2021-06-26 07:12:32 +0200 |
| commit | de895b43932cb47e69480540be7eca289af24f23 (patch) | |
| tree | f77ee29911c317d9a7e4c47cc4d5d7088dd92d0b /net | |
| parent | 1fa20d7d4aad02206e84b74915819fbe9f81dab3 (diff) | |
Bluetooth: L2CAP: Fix invalid access on ECRED Connection response
The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index f3b70fa348ab..9ebb85df4db4 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6066,7 +6066,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, struct l2cap_ecred_conn_rsp *rsp = (void *) data; struct hci_conn *hcon = conn->hcon; u16 mtu, mps, credits, result; - struct l2cap_chan *chan; + struct l2cap_chan *chan, *tmp; int err = 0, sec_level; int i = 0; @@ -6085,7 +6085,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, cmd_len -= sizeof(*rsp); - list_for_each_entry(chan, &conn->chan_l, list) { + list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { u16 dcid; if (chan->ident != cmd->ident || |