diff options
| author | Ulisses Furquim <ulisses@profusion.mobi> | 2012-01-30 21:26:29 +0100 |
|---|---|---|
| committer | Johan Hedberg <johan.hedberg@intel.com> | 2012-02-15 12:09:26 +0100 |
| commit | 24d2b8c0ac5c8ec41c26ed432238b0e027184882 (patch) | |
| tree | d0331d56b1f94b3614eaade10ca5d1ca0ba8633c /net | |
| parent | Bluetooth: Remove usage of __cancel_delayed_work() (diff) | |
| download | linux-24d2b8c0ac5c8ec41c26ed432238b0e027184882.tar.xz linux-24d2b8c0ac5c8ec41c26ed432238b0e027184882.zip | |
Bluetooth: Fix possible use after free in delete path
We need to use the _sync() version for cancelling the info and security
timer in the L2CAP connection delete path. Otherwise the delayed work
handler might run after the connection object is freed.
Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index ec10c698b891..32d338c30e65 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1018,10 +1018,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) hci_chan_del(conn->hchan); if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) - __cancel_delayed_work(&conn->info_timer); + cancel_delayed_work_sync(&conn->info_timer); if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) { - __cancel_delayed_work(&conn->security_timer); + cancel_delayed_work_sync(&conn->security_timer); smp_chan_destroy(conn); } |