github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: L2CAP: hold l2cap_conn::lock in l2cap_connect_cfm()

Browse Source 
l2cap_new_connection() -> __l2cap_chan_add() modifies
l2cap_conn::chan_l, which is guarded by l2cap_conn::lock. The lock is
not held in l2cap_connect_cfm().

Fix by holding conn->lock in l2cap_connect_cfm() to make the locking
systematic.

Fixes: ab4eedb790 ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pauli Virtanen 2026-08-29 17:20:03 +03:00 committed by Luiz Augusto von Dentz
parent 32d86e048d
commit 115e6a21c8
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/bluetooth/l2cap_core.c
View File

@ -7656,6 +7656,8 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
* we left off, because the list lock would prevent calling the
* potentially sleeping l2cap_chan_lock() function.
*/
mutex_lock(&conn->lock);
pchan = l2cap_global_fixed_chan(NULL, hcon);
while (pchan) {
struct l2cap_chan *chan, *next;
@ -7680,6 +7682,8 @@ static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
pchan = next;
}
mutex_unlock(&conn->lock);
l2cap_conn_ready(conn);
}