qiurui
/
Centos-kernel-stream-9
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression 

Bugzilla: http://bugzilla.redhat.com/2124521

commit 332f1795ca202489c665a75e62e18ff6284de077
Author: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date:   Mon Aug 1 13:52:07 2022 -0700

    Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression

    The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused
    by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch
    static checker warning:

            net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
            error: we previously assumed 'c' could be null (see line 1996)

    Fixes: d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put")
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

Signed-off-by: Gopal Tiwari <gtiwari@redhat.com>
This commit is contained in:
Gopal Tiwari 2022-10-18 10:30:35 +05:30
parent 1c12ec3480
commit b9aa9b1ad1
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/bluetooth/l2cap_core.c
View File

@ -1970,11 +1970,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
bdaddr_t *dst,
u8 link_type)
{
struct l2cap_chan *c, *c1 = NULL;
struct l2cap_chan *c, *tmp, *c1 = NULL;
read_lock(&chan_list_lock);
list_for_each_entry(c, &chan_list, global_l) {
list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
if (state && c->state != state)
continue;
@ -1993,11 +1993,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
dst_match = !bacmp(&c->dst, dst);
if (src_match && dst_match) {
c = l2cap_chan_hold_unless_zero(c);
if (!c)
continue;
read_unlock(&chan_list_lock);
return c;
if (c) {
read_unlock(&chan_list_lock);
return c;
}
}
/* Closest match */