diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-08-29 17:20:06 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-10-14 13:26:59 -0400 |
| commit | b508a2a2d846ccc4c8f691e4e3dfca6f97dfe85a (patch) | |
| tree | b4831678ba2a55ed6ae4d259ac548b78ec1375c8 /include/net | |
| parent | 889dfdde79e27e0f00b6fa08704e240a42c4ccac (diff) | |
| download | linux-b508a2a2d846ccc4c8f691e4e3dfca6f97dfe85a.tar.gz linux-b508a2a2d846ccc4c8f691e4e3dfca6f97dfe85a.zip | |
Bluetooth: L2CAP: hold chan in l2cap_ecred_conn_rsp()
l2cap_chan_del() calls l2cap_chan_put() to drop the conn->chan_l
reference. If this was the last reference, UAF follows.
l2cap_ecred_conn_rsp() iterates chan_l list and calls l2cap_chan_del()
on some members, without holding chan reference.
Fix by holding refcount while using chan after l2cap_chan_del().
Since orig is looked up by dcid provided by remote, it's also possible
orig == chan, so reference needs to be held also after orig use.
Fixes: 41c2713b204e ("Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp")
Assisted-by: deepseek-v4-flash
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/net')
0 files changed, 0 insertions, 0 deletions