Bluetooth: L2CAP ERTM shutdown protect sk and chan
authorDean Jenkins <Dean_Jenkins@mentor.com>
Tue, 23 Jun 2015 16:59:32 +0000 (17:59 +0100)
committerMarcel Holtmann <marcel@holtmann.org>
Thu, 23 Jul 2015 15:10:50 +0000 (17:10 +0200)
commit2baea85dec1aebe0b100d4836dee8bcf29a51e94
tree4e64ae9832fb263dd317b89e424456a98838ff56
parentd10270ce941ee89afd74076ea3ed8dbef8a0ff25
Bluetooth: L2CAP ERTM shutdown protect sk and chan

During execution of l2cap_sock_shutdown() which might
sleep, the sk and chan structures can be in an unlocked
condition which potentially allows the structures to be
freed by other running threads. Therefore, there is a
possibility of a malfunction or memory reuse after being
freed.

Keep the sk and chan structures alive during the
execution of l2cap_sock_shutdown() by using their
respective hold and put functions. This allows the structures
to be freeable at the end of l2cap_sock_shutdown().

Signed-off-by: Kautuk Consul <Kautuk_Consul@mentor.com>
Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/l2cap_sock.c