Bluetooth: Fix possible access of hci_chan after it is deleted
When the connection is not in BT_CONNECTED state it was possible
for code in hci_chan_modify() to attempt to access the hci_chan
structure after it had already been deleted by hci_chan_put().
Change-Id: I5ae352ac12aa3b456e7bcf30633015d98b03e44b
CRs-fixed: 319934
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5e67829..95718bb 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -505,13 +505,13 @@
return 0;
}
-void hci_chan_put(struct hci_chan *chan)
+int hci_chan_put(struct hci_chan *chan)
{
struct hci_cp_disconn_logical_link cp;
BT_DBG("chan %p refcnt %d", chan, atomic_read(&chan->refcnt));
if (!atomic_dec_and_test(&chan->refcnt))
- return;
+ return 0;
BT_DBG("chan->conn->state %d", chan->conn->state);
if (chan->conn->state == BT_CONNECTED) {
@@ -520,6 +520,8 @@
sizeof(cp), &cp);
} else
hci_chan_del(chan);
+
+ return 1;
}
EXPORT_SYMBOL(hci_chan_put);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4c50713..e866248 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -549,8 +549,7 @@
l2cap_pi(sk)->ampcon->l2cap_data = NULL;
l2cap_pi(sk)->ampcon = NULL;
if (l2cap_pi(sk)->ampchan) {
- hci_chan_put(l2cap_pi(sk)->ampchan);
- if (atomic_read(&l2cap_pi(sk)->ampchan->refcnt))
+ if (!hci_chan_put(l2cap_pi(sk)->ampchan))
l2cap_deaggregate(l2cap_pi(sk)->ampchan,
l2cap_pi(sk));
}
@@ -5056,8 +5055,7 @@
if ((!l2cap_pi(sk)->amp_id) &&
(l2cap_pi(sk)->ampchan)) {
/* Have moved off of AMP, free the channel */
- hci_chan_put(l2cap_pi(sk)->ampchan);
- if (atomic_read(&l2cap_pi(sk)->ampchan->refcnt))
+ if (!hci_chan_put(l2cap_pi(sk)->ampchan))
l2cap_deaggregate(l2cap_pi(sk)->ampchan,
l2cap_pi(sk));
l2cap_pi(sk)->ampchan = NULL;
@@ -5115,8 +5113,7 @@
/* Have moved off of AMP, free the channel */
l2cap_pi(sk)->ampcon = NULL;
if (l2cap_pi(sk)->ampchan) {
- hci_chan_put(l2cap_pi(sk)->ampchan);
- if (atomic_read(&l2cap_pi(sk)->ampchan->refcnt))
+ if (!hci_chan_put(l2cap_pi(sk)->ampchan))
l2cap_deaggregate(l2cap_pi(sk)->ampchan,
l2cap_pi(sk));
}