Bluetooth: Fix possible access of hci_chan after it is deleted
When the connection is not in BT_CONNECTED state it was possible
for code in hci_chan_modify() to attempt to access the hci_chan
structure after it had already been deleted by hci_chan_put().
Change-Id: I5ae352ac12aa3b456e7bcf30633015d98b03e44b
CRs-fixed: 319934
Signed-off-by: Peter Krystad <pkrystad@codeaurora.org>
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 5e67829..95718bb 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -505,13 +505,13 @@
return 0;
}
-void hci_chan_put(struct hci_chan *chan)
+int hci_chan_put(struct hci_chan *chan)
{
struct hci_cp_disconn_logical_link cp;
BT_DBG("chan %p refcnt %d", chan, atomic_read(&chan->refcnt));
if (!atomic_dec_and_test(&chan->refcnt))
- return;
+ return 0;
BT_DBG("chan->conn->state %d", chan->conn->state);
if (chan->conn->state == BT_CONNECTED) {
@@ -520,6 +520,8 @@
sizeof(cp), &cp);
} else
hci_chan_del(chan);
+
+ return 1;
}
EXPORT_SYMBOL(hci_chan_put);