diff options
| author | Nguyen Dinh Phi <phind.uet@gmail.com> | 2021-10-08 03:04:24 +0800 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2021-10-12 17:30:17 +0200 |
| commit | 709fca500067524381e28a5f481882930eebac88 (patch) | |
| tree | 41d0f53858694b66ad874bf140a762a1cb0a4fec /net/bluetooth/l2cap_sock.c | |
| parent | b15bfa4df63529150df9ff0585675f728436e0c1 (diff) | |
| download | linux-709fca500067524381e28a5f481882930eebac88.tar.gz linux-709fca500067524381e28a5f481882930eebac88.tar.bz2 linux-709fca500067524381e28a5f481882930eebac88.zip | |
Bluetooth: hci_sock: purge socket queues in the destruct() callback
The receive path may take the socket right before hci_sock_release(),
but it may enqueue the packets to the socket queues after the call to
skb_queue_purge(), therefore the socket can be destroyed without clear
its queues completely.
Moving these skb_queue_purge() to the hci_sock_destruct() will fix this
issue, because nothing is referencing the socket at this point.
Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth/l2cap_sock.c')
0 files changed, 0 insertions, 0 deletions