diff options
| author |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-11 12:09:42 -0400 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-28 08:52:20 -0400 |
| commit | 41c2713b204e6cb6a94587bc6bf6935107df5479 (patch) | |
| tree | cbbc609498b8b4ea5d94157276bc52455b85029c /tools/perf/arch/ssh:/git@git.zx2c4.com/git: | |
| parent | Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (diff) | |
Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and
in fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected.
Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so
instead schedule l2cap_chan_timeout with delay 0 to close the channel
asynchronously.
Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'tools/perf/arch/ssh:/git@git.zx2c4.com/git:')
0 files changed, 0 insertions, 0 deletions