summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorUlisses Furquim <ulisses@profusion.mobi>2012-01-30 18:26:29 -0200
committerJohan Hedberg <johan.hedberg@intel.com>2012-02-15 13:09:26 +0200
commit24d2b8c0ac5c8ec41c26ed432238b0e027184882 (patch)
treed0331d56b1f94b3614eaade10ca5d1ca0ba8633c /net
parent6de32750822d00bfa92c341166132b0714c5b559 (diff)
Bluetooth: Fix possible use after free in delete path
We need to use the _sync() version for cancelling the info and security timer in the L2CAP connection delete path. Otherwise the delayed work handler might run after the connection object is freed. Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi> Acked-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/l2cap_core.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ec10c698b891..32d338c30e65 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1018,10 +1018,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
hci_chan_del(conn->hchan);
if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
- __cancel_delayed_work(&conn->info_timer);
+ cancel_delayed_work_sync(&conn->info_timer);
if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
- __cancel_delayed_work(&conn->security_timer);
+ cancel_delayed_work_sync(&conn->security_timer);
smp_chan_destroy(conn);
}