diff options
author | Ulisses Furquim <ulisses@profusion.mobi> | 2012-01-30 15:26:29 -0500 |
---|---|---|
committer | Johan Hedberg <johan.hedberg@intel.com> | 2012-02-13 10:01:30 -0500 |
commit | 127074bfa3c11c12e0160437e31b08c6b27412a4 (patch) | |
tree | a70a9ecb8673139263c6f4a631660d15753d9891 /net/bluetooth/l2cap_core.c | |
parent | 17cd3f374be6648bd46c86ff8f2a2511d3f416ee (diff) |
Bluetooth: Fix possible use after free in delete path
We need to use the _sync() version for cancelling the info and security
timer in the L2CAP connection delete path. Otherwise the delayed work
handler might run after the connection object is freed.
Signed-off-by: Ulisses Furquim <ulisses@profusion.mobi>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net/bluetooth/l2cap_core.c')
-rw-r--r-- | net/bluetooth/l2cap_core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index ae7fb27525d..09cd8601ea8 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c | |||
@@ -1016,10 +1016,10 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err) | |||
1016 | hci_chan_del(conn->hchan); | 1016 | hci_chan_del(conn->hchan); |
1017 | 1017 | ||
1018 | if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) | 1018 | if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) |
1019 | __cancel_delayed_work(&conn->info_timer); | 1019 | cancel_delayed_work_sync(&conn->info_timer); |
1020 | 1020 | ||
1021 | if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) { | 1021 | if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) { |
1022 | __cancel_delayed_work(&conn->security_timer); | 1022 | cancel_delayed_work_sync(&conn->security_timer); |
1023 | smp_chan_destroy(conn); | 1023 | smp_chan_destroy(conn); |
1024 | } | 1024 | } |
1025 | 1025 | ||