Commit 1fa20d7d authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Marcel Holtmann
Browse files

Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails 



The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 1c58e933

net/bluetooth/l2cap_core.c

+2 −2
Original line number Diff line number Diff line
@@ -6248,7 +6248,7 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 
					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,

					 u8 *data)

{

	struct l2cap_chan *chan;

	struct l2cap_chan *chan, *tmp;

	struct l2cap_ecred_conn_rsp *rsp = (void *) data;

	u16 result;
@@ -6262,7 +6262,7 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 
	if (!result)

		return 0;



	list_for_each_entry(chan, &conn->chan_l, list) {

	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {

		if (chan->ident != cmd->ident)

			continue;