Bluetooth: L2CAP: Fix invalid access on ECRED Connection response

The use of l2cap_chan_del is not safe under a loop using
list_for_each_entry.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index f3b70fa348abd7499aee4b68f47c7e3e565158f2..9ebb85df4db48bb694fdebee8dc6a915e0c741c3 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6066,7 +6066,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
        struct l2cap_ecred_conn_rsp *rsp = (void *) data;
        struct hci_conn *hcon = conn->hcon;
        u16 mtu, mps, credits, result;
-       struct l2cap_chan *chan;
+       struct l2cap_chan *chan, *tmp;
        int err = 0, sec_level;
        int i = 0;
 
@@ -6085,7 +6085,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
 
        cmd_len -= sizeof(*rsp);
 
-       list_for_each_entry(chan, &conn->chan_l, list) {
+       list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
                u16 dcid;
 
                if (chan->ident != cmd->ident ||