diff options
| author | Dudu Lu <phx0fer@gmail.com> | 2026-04-05 18:47:41 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-04-13 16:19:42 +0300 |
| commit | 42776497cdbc9a665b384a6dcb85f0d4bd927eab (patch) | |
| tree | 7e64b4ccd73d97ca57c858f8c23ac3880915bcbd /include/linux/stringify.h | |
| parent | 1c0bc11cd445ba8235ac8ec87d5999b6769ed8b9 (diff) | |
| download | linux-42776497cdbc9a665b384a6dcb85f0d4bd927eab.tar.xz | |
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/stringify.h')
0 files changed, 0 insertions, 0 deletions