diff options
author | Ruihan Li <lrh2000@pku.edu.cn> | 2023-05-03 16:39:35 +0300 |
---|---|---|
committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-05-20 01:37:45 +0300 |
commit | 2910431ab0e500dfc5df12299bb15eef0f30b43e (patch) | |
tree | 0e8602d8977512314b7d7780f3d119c1df38675f /net/xfrm | |
parent | ca1fd42e7dbfcb34890ffbf1f2f4b356776dab6f (diff) | |
download | linux-2910431ab0e500dfc5df12299bb15eef0f30b43e.tar.xz |
Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
If hci_conn_put(conn->parent) reduces conn->parent's reference count to
zero, it can immediately deallocate conn->parent. At the same time,
conn->link->list has its head in conn->parent, causing use-after-free
problems in the latter list_del_rcu(&conn->link->list).
This problem can be easily solved by reordering the two operations,
i.e., first performing the list removal with list_del_rcu and then
decreasing the refcnt with hci_conn_put.
Reported-by: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Closes: https://lore.kernel.org/linux-bluetooth/CABBYNZ+1kce8_RJrLNOXd_8=Mdpb=2bx4Nto-hFORk=qiOkoCg@mail.gmail.com/
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'net/xfrm')
0 files changed, 0 insertions, 0 deletions