Unverified Commit 6cbfc80d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!1807 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb 

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/SSEHK2X4FXLBNQQWQWI356DBSZU5ABK6/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7SXVG 
 
Link:https://gitee.com/openeuler/kernel/pulls/1807

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
parents cf3c4fa6 ba8196b0

net/bluetooth/l2cap_sock.c

+2 −0
Original line number Diff line number Diff line
@@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops; 
static void l2cap_sock_init(struct sock *sk, struct sock *parent);

static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,

				     int proto, gfp_t prio, int kern);

static void l2cap_sock_cleanup_listen(struct sock *parent);



bool l2cap_is_socket(struct socket *sock)

{
@@ -1196,6 +1197,7 @@ static int l2cap_sock_release(struct socket *sock) 
	if (!sk)

		return 0;



	l2cap_sock_cleanup_listen(sk);

	bt_sock_unlink(&l2cap_sk_list, sk);



	err = l2cap_sock_shutdown(sock, 2);