未验证 提交 6cbfc80d 编写于 作者: O openeuler-ci-bot 提交者: Gitee

!1807 Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb

Merge Pull Request from: @ci-robot 
 
PR sync from: Dong Chenchen <dongchenchen2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/SSEHK2X4FXLBNQQWQWI356DBSZU5ABK6/ 
 
https://gitee.com/src-openeuler/kernel/issues/I7SXVG 
 
Link:https://gitee.com/openeuler/kernel/pulls/1807 

Reviewed-by: Yue Haibing <yuehaibing@huawei.com> 
Signed-off-by: Liu YongQiang <liuyongqiang13@huawei.com> 
...@@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops; ...@@ -45,6 +45,7 @@ static const struct proto_ops l2cap_sock_ops;
static void l2cap_sock_init(struct sock *sk, struct sock *parent); static void l2cap_sock_init(struct sock *sk, struct sock *parent);
static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
int proto, gfp_t prio, int kern); int proto, gfp_t prio, int kern);
static void l2cap_sock_cleanup_listen(struct sock *parent);
bool l2cap_is_socket(struct socket *sock) bool l2cap_is_socket(struct socket *sock)
{ {
...@@ -1196,6 +1197,7 @@ static int l2cap_sock_release(struct socket *sock) ...@@ -1196,6 +1197,7 @@ static int l2cap_sock_release(struct socket *sock)
if (!sk) if (!sk)
return 0; return 0;
l2cap_sock_cleanup_listen(sk);
bt_sock_unlink(&l2cap_sk_list, sk); bt_sock_unlink(&l2cap_sk_list, sk);
err = l2cap_sock_shutdown(sock, 2); err = l2cap_sock_shutdown(sock, 2);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册