mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 15:18:19 +00:00
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
commit332f1795ca
upstream. The patchd0be8347c6
: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch static checker warning: net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm() error: we previously assumed 'c' could be null (see line 1996) Fixes:d0be8347c6
("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
127f323c46
commit
5f776b8b32
1 changed files with 6 additions and 7 deletions
|
@ -1804,11 +1804,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
|
|||
bdaddr_t *dst,
|
||||
u8 link_type)
|
||||
{
|
||||
struct l2cap_chan *c, *c1 = NULL;
|
||||
struct l2cap_chan *c, *tmp, *c1 = NULL;
|
||||
|
||||
read_lock(&chan_list_lock);
|
||||
|
||||
list_for_each_entry(c, &chan_list, global_l) {
|
||||
list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
|
||||
if (state && c->state != state)
|
||||
continue;
|
||||
|
||||
|
@ -1827,11 +1827,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
|
|||
dst_match = !bacmp(&c->dst, dst);
|
||||
if (src_match && dst_match) {
|
||||
c = l2cap_chan_hold_unless_zero(c);
|
||||
if (!c)
|
||||
continue;
|
||||
|
||||
read_unlock(&chan_list_lock);
|
||||
return c;
|
||||
if (c) {
|
||||
read_unlock(&chan_list_lock);
|
||||
return c;
|
||||
}
|
||||
}
|
||||
|
||||
/* Closest match */
|
||||
|
|
Loading…
Reference in a new issue