Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}

Similar to commit d0be8347 ("Bluetooth: L2CAP: Fix use-after-free
caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to
prevent referencing a channel that is about to be destroyed.

Cc: stable@kernel.org
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarMin Li <lm0963hack@gmail.com>
parent d2e4f1b1
...@@ -4652,33 +4652,27 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, ...@@ -4652,33 +4652,27 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
mutex_lock(&conn->chan_lock); chan = l2cap_get_chan_by_scid(conn, dcid);
chan = __l2cap_get_chan_by_scid(conn, dcid);
if (!chan) { if (!chan) {
mutex_unlock(&conn->chan_lock);
cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
return 0; return 0;
} }
l2cap_chan_hold(chan);
l2cap_chan_lock(chan);
rsp.dcid = cpu_to_le16(chan->scid); rsp.dcid = cpu_to_le16(chan->scid);
rsp.scid = cpu_to_le16(chan->dcid); rsp.scid = cpu_to_le16(chan->dcid);
l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
chan->ops->set_shutdown(chan); chan->ops->set_shutdown(chan);
mutex_lock(&conn->chan_lock);
l2cap_chan_del(chan, ECONNRESET); l2cap_chan_del(chan, ECONNRESET);
mutex_unlock(&conn->chan_lock);
chan->ops->close(chan); chan->ops->close(chan);
l2cap_chan_unlock(chan); l2cap_chan_unlock(chan);
l2cap_chan_put(chan); l2cap_chan_put(chan);
mutex_unlock(&conn->chan_lock);
return 0; return 0;
} }
...@@ -4698,33 +4692,27 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, ...@@ -4698,33 +4692,27 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
mutex_lock(&conn->chan_lock); chan = l2cap_get_chan_by_scid(conn, scid);
chan = __l2cap_get_chan_by_scid(conn, scid);
if (!chan) { if (!chan) {
mutex_unlock(&conn->chan_lock); mutex_unlock(&conn->chan_lock);
return 0; return 0;
} }
l2cap_chan_hold(chan);
l2cap_chan_lock(chan);
if (chan->state != BT_DISCONN) { if (chan->state != BT_DISCONN) {
l2cap_chan_unlock(chan); l2cap_chan_unlock(chan);
l2cap_chan_put(chan); l2cap_chan_put(chan);
mutex_unlock(&conn->chan_lock);
return 0; return 0;
} }
mutex_lock(&conn->chan_lock);
l2cap_chan_del(chan, 0); l2cap_chan_del(chan, 0);
mutex_unlock(&conn->chan_lock);
chan->ops->close(chan); chan->ops->close(chan);
l2cap_chan_unlock(chan); l2cap_chan_unlock(chan);
l2cap_chan_put(chan); l2cap_chan_put(chan);
mutex_unlock(&conn->chan_lock);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment