git.maquefel.me Git - linux.git/commit

author	Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
	Wed, 1 Feb 2023 22:01:11 +0000 (14:01 -0800)
committer	Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
	Thu, 9 Feb 2023 22:18:48 +0000 (14:18 -0800)
commit	df5703348813235874d851934e957c3723d71644
tree	aa8217ebec403131c1524a365c6ac6e70fe71302	tree \| snapshot
parent	2394186a2cefb9a45a029281a55749804dd8c556	commit \| diff

Bluetooth: L2CAP: Fix potential user-after-free

This fixes all instances of which requires to allocate a buffer calling
alloc_skb which may release the chan lock and reacquire later which
makes it possible that the chan is disconnected in the meantime.

Fixes: a6a5568c03c4 ("Bluetooth: Lock the L2CAP channel when sending")
Reported-by: Alexander Coffin <alex.coffin@matician.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

net/bluetooth/l2cap_core.c		diff \| blob \| history
net/bluetooth/l2cap_sock.c		diff \| blob \| history

ep93xx device tree rework repo: git://git.maquefel.me/linux.git

RSS Atom