Messages in this thread Patch in this message | | | From | Jianglei Nie <> | Subject | [PATCH] Bluetooth: hci_conn: fix potential double free in le_scan_cleanup() | Date | Thu, 26 May 2022 17:49:18 +0800 |
| |
When "c == conn" is true, hci_conn_cleanup() is called. The hci_conn_cleanup() calls hci_dev_put() and hci_conn_put() in its function implementation. hci_dev_put() and hci_conn_put() will free the relevant resource if the reference count reaches zero, which may lead to a double free when hci_dev_put() and hci_conn_put() are called again.
We should add a return to this function after hci_conn_cleanup() is called.
Signed-off-by: Jianglei Nie <niejianglei2021@163.com> --- net/bluetooth/hci_conn.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index fe803bee419a..7b3e91eb9fa3 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -166,6 +166,7 @@ static void le_scan_cleanup(struct work_struct *work) if (c == conn) { hci_connect_le_scan_cleanup(conn); hci_conn_cleanup(conn); + return; } hci_dev_unlock(hdev); -- 2.25.1
| |