diff options
| author |   Thomas Gleixner <tglx@linutronix.de> | 2024-08-02 14:10:55 +0200 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2024-08-02 14:10:55 +0200 |
| commit | 4436e6da008fee87d54c038e983e5be9a6baf8fb (patch) | |
| tree | 265a15efcf6f17e0e32e258d66b274fc5cad41d4 /net/bluetooth/l2cap_sock.c | |
| parent | x86/mm: Cleanup prctl_enable_tagged_addr() nr_bits error checking (diff) | |
| parent | Linux 6.11-rc1 (diff) | |
| download | wireguard-linux-4436e6da008fee87d54c038e983e5be9a6baf8fb.tar.xz wireguard-linux-4436e6da008fee87d54c038e983e5be9a6baf8fb.zip | |
Merge branch 'linus' into x86/mm
Bring x86 and selftests up to date
Diffstat (limited to 'net/bluetooth/l2cap_sock.c')
| -rw-r--r-- | net/bluetooth/l2cap_sock.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 6db60946c627..ba437c6f6ee5 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1239,6 +1239,10 @@ static void l2cap_sock_kill(struct sock *sk) BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state)); + /* Sock is dead, so set chan data to NULL, avoid other task use invalid + * sock pointer. + */ + l2cap_pi(sk)->chan->data = NULL; /* Kill poor orphan */ l2cap_chan_put(l2cap_pi(sk)->chan); @@ -1481,12 +1485,16 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb) { - struct sock *sk = chan->data; - struct l2cap_pinfo *pi = l2cap_pi(sk); + struct sock *sk; + struct l2cap_pinfo *pi; int err; - lock_sock(sk); + sk = chan->data; + if (!sk) + return -ENXIO; + pi = l2cap_pi(sk); + lock_sock(sk); if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) { err = -ENOMEM; goto done; |