diff options
| author | Pauli Virtanen <pav@iki.fi> | 2026-08-29 17:19:58 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-10-14 13:24:33 -0400 |
| commit | 79ff49a72c06abdf76872dccc687e2a83c4f407f (patch) | |
| tree | 624fbe04eb35e1cd0f03a03e28382705541bc83c /include | |
| parent | 608e0b7a675b2affbbf38167cad0fa63d8e064f7 (diff) | |
Bluetooth: L2CAP: fix race condition in l2cap_sock_shutdown()
l2cap_sock_shutdown() has the race condition
[Task 1] [Task 2]
l2cap_sock_shutdown l2cap_sock_connect
l2cap_chan_lock l2cap_chan_connect
conn = ... /* == NULL*/
l2cap_chan_unlock ------------> l2cap_chan_lock
if (conn) /* false */
__l2cap_chan_add(conn, chan)
l2cap_chan_lock <-------------- l2cap_chan_unlock
l2cap_chan_close /* chan->conn->lock not held! */
conn->lock protects conn->chan_l and is not properly held here.
Use the l2cap_chan_close_unlocked() helper that ensures conn->lock is
held for l2cap_chan_close().
Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
Link: https://lore.kernel.org/linux-bluetooth/20260824153908.2327306-1-jjy600901@snu.ac.kr/
Link: https://syzkaller.appspot.com/bug?extid=0e4ebcc970728e056324
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include')
0 files changed, 0 insertions, 0 deletions