diff options
| author |   Dudu Lu <phx0fer@gmail.com> | 2026-04-05 23:47:41 +0800 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-04-13 09:19:42 -0400 |
| commit | 42776497cdbc9a665b384a6dcb85f0d4bd927eab (patch) | |
| tree | 7e64b4ccd73d97ca57c858f8c23ac3880915bcbd /samples/kobject/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x (diff) | |
Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp
l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.
Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'samples/kobject/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions