From: Luiz Augusto von Dentz Date: Wed, 19 May 2021 20:41:51 +0000 (-0700) Subject: Bluetooth: L2CAP: Fix invalid access on ECRED Connection response X-Git-Tag: v5.12.18~95 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a280eb5543b9e0979dde7a11469d2d0030c73ef0;p=thirdparty%2Fkernel%2Fstable.git Bluetooth: L2CAP: Fix invalid access on ECRED Connection response [ Upstream commit de895b43932cb47e69480540be7eca289af24f23 ] The use of l2cap_chan_del is not safe under a loop using list_for_each_entry. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Signed-off-by: Sasha Levin --- diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 015f9ecadd0a8..b1f4d5505bbac 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6062,7 +6062,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, struct l2cap_ecred_conn_rsp *rsp = (void *) data; struct hci_conn *hcon = conn->hcon; u16 mtu, mps, credits, result; - struct l2cap_chan *chan; + struct l2cap_chan *chan, *tmp; int err = 0, sec_level; int i = 0; @@ -6081,7 +6081,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, cmd_len -= sizeof(*rsp); - list_for_each_entry(chan, &conn->chan_l, list) { + list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { u16 dcid; if (chan->ident != cmd->ident ||