Commit 9dbd8499 authored by Siwei Zhang's avatar Siwei Zhang Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn 



__set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold()
before scheduling the delayed work.  The normal path in
l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the
end, but the early return when chan->conn is NULL skips the put,
leaking the reference.

Add the missing l2cap_chan_put() before the early return.

Fixes: adf0398c ("Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarSiwei Zhang <oss@fourdim.xyz>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent bfa9d289

net/bluetooth/l2cap_core.c

+3 −1
Original line number Diff line number Diff line
@@ -411,8 +411,10 @@ static void l2cap_chan_timeout(struct work_struct *work) 


	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));



	if (!conn)

	if (!conn) {

		l2cap_chan_put(chan);

		return;

	}



	mutex_lock(&conn->lock);

	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling