Bluetooth: L2CAP ERTM shutdown protect sk and chan
During execution of l2cap_sock_shutdown() which might sleep, the sk and chan structures can be in an unlocked condition which potentially allows the structures to be freed by other running threads. Therefore, there is a possibility of a malfunction or memory reuse after being freed. Keep the sk and chan structures alive during the execution of l2cap_sock_shutdown() by using their respective hold and put functions. This allows the structures to be freeable at the end of l2cap_sock_shutdown(). Signed-off-by: Kautuk Consul <Kautuk_Consul@mentor.com> Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Родитель
d10270ce94
Коммит
2baea85dec
|
@ -1098,7 +1098,12 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
|
||||||
if (!sk)
|
if (!sk)
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
/* prevent sk structure from being freed whilst unlocked */
|
||||||
|
sock_hold(sk);
|
||||||
|
|
||||||
chan = l2cap_pi(sk)->chan;
|
chan = l2cap_pi(sk)->chan;
|
||||||
|
/* prevent chan structure from being freed whilst unlocked */
|
||||||
|
l2cap_chan_hold(chan);
|
||||||
conn = chan->conn;
|
conn = chan->conn;
|
||||||
|
|
||||||
BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
|
BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
|
||||||
|
@ -1134,6 +1139,9 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
|
||||||
if (conn)
|
if (conn)
|
||||||
mutex_unlock(&conn->chan_lock);
|
mutex_unlock(&conn->chan_lock);
|
||||||
|
|
||||||
|
l2cap_chan_put(chan);
|
||||||
|
sock_put(sk);
|
||||||
|
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Загрузка…
Ссылка в новой задаче