diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2022-09-29 13:27:13 -0700 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2022-09-29 13:27:13 -0700 |
| commit | 35fcbc4243aad7e7d020b7c1dfb14bb888b20a4f (patch) | |
| tree | 72f91a2cb395e1ac368d9ba61959479bdc153245 /arch/xtensa/Kconfig | |
| parent | 8dbc3e75a0a56fb0ab70781338a2283d28a09164 (diff) | |
Bluetooth: L2CAP: Fix user-after-free
This uses l2cap_chan_hold_unless_zero() after calling
__l2cap_get_chan_blah() to prevent the following trace:
Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref
*kref)
Bluetooth: chan 0000000023c4974d
Bluetooth: parent 00000000ae861c08
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first
kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common
kernel/locking/mutex.c:671 [inline]
BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400
kernel/locking/mutex.c:729
Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389
Link: https://lore.kernel.org/lkml/20220622082716.478486-1-lee.jones@linaro.org
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Diffstat (limited to 'arch/xtensa/Kconfig')
0 files changed, 0 insertions, 0 deletions