Commit de895b43 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz Committed by Marcel Holtmann
Browse files

Bluetooth: L2CAP: Fix invalid access on ECRED Connection response 



The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.

Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 1fa20d7d

net/bluetooth/l2cap_core.c

+2 −2
Original line number Diff line number Diff line
@@ -6066,7 +6066,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 
	struct l2cap_ecred_conn_rsp *rsp = (void *) data;

	struct hci_conn *hcon = conn->hcon;

	u16 mtu, mps, credits, result;

	struct l2cap_chan *chan;

	struct l2cap_chan *chan, *tmp;

	int err = 0, sec_level;

	int i = 0;
@@ -6085,7 +6085,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 


	cmd_len -= sizeof(*rsp);



	list_for_each_entry(chan, &conn->chan_l, list) {

	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {

		u16 dcid;



		if (chan->ident != cmd->ident ||