lkml.org 
[lkml]   [2022]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 1157/1157] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
    Date
    From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

    commit 332f1795ca202489c665a75e62e18ff6284de077 upstream.

    The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused
    by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch
    static checker warning:

    net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
    error: we previously assumed 'c' could be null (see line 1996)

    Fixes: d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put")
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/bluetooth/l2cap_core.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    --- a/net/bluetooth/l2cap_core.c
    +++ b/net/bluetooth/l2cap_core.c
    @@ -1969,11 +1969,11 @@ static struct l2cap_chan *l2cap_global_c
    bdaddr_t *dst,
    u8 link_type)
    {
    - struct l2cap_chan *c, *c1 = NULL;
    + struct l2cap_chan *c, *tmp, *c1 = NULL;

    read_lock(&chan_list_lock);

    - list_for_each_entry(c, &chan_list, global_l) {
    + list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
    if (state && c->state != state)
    continue;

    @@ -1992,11 +1992,10 @@ static struct l2cap_chan *l2cap_global_c
    dst_match = !bacmp(&c->dst, dst);
    if (src_match && dst_match) {
    c = l2cap_chan_hold_unless_zero(c);
    - if (!c)
    - continue;
    -
    - read_unlock(&chan_list_lock);
    - return c;
    + if (c) {
    + read_unlock(&chan_list_lock);
    + return c;
    + }
    }

    /* Closest match */

    \
     
     \ /
      Last update: 2022-08-16 06:59    [W:2.671 / U:0.404 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site