diff mbox series

[v2] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression

Message ID 20220801225702.2278772-1-luiz.dentz@gmail.com
State New
Headers show
Series [v2] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression | expand

Commit Message

Luiz Augusto von Dentz Aug. 1, 2022, 10:57 p.m. UTC 
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused
by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch
static checker warning:

        net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
        error: we previously assumed 'c' could be null (see line 1996)

Fixes: d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
v2: Fix lkp findings.

 net/bluetooth/l2cap_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

patchwork-bot+bluetooth@kernel.org Aug. 4, 2022, midnight UTC | #1 
Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon,  1 Aug 2022 15:57:02 -0700 you wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> 
> The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused
> by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch
> static checker warning:
> 
>         net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
>         error: we previously assumed 'c' could be null (see line 1996)
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
    https://git.kernel.org/bluetooth/bluetooth-next/c/600f1aff2dcb

You are awesome, thank you!
diff mbox series

Patch

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 77c0aac14539..1c39fc40591b 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1970,11 +1970,11 @@  static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
 						   bdaddr_t *dst,
 						   u8 link_type)
 {
-	struct l2cap_chan *c, *c1 = NULL;
+	struct l2cap_chan *c, *tmp, *c1 = NULL;
 
 	read_lock(&chan_list_lock);
 
-	list_for_each_entry(c, &chan_list, global_l) {
+	list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
 		if (state && c->state != state)
 			continue;