diff mbox series

Bluetooth: l2cap: always unlock channel in l2cap_conless_channel()

Message ID 20240731091936.476484-1-dmantipov@yandex.ru
State Accepted
Commit c531e63871c0b50c8c4e62c048535a08886fba3e
Headers show
Series Bluetooth: l2cap: always unlock channel in l2cap_conless_channel() | expand

Commit Message

Dmitry Antipov July 31, 2024, 9:19 a.m. UTC
Add missing call to 'l2cap_chan_unlock()' on receive error handling
path in 'l2cap_conless_channel()'.

Fixes: a24cce144b98 ("Bluetooth: Fix reference counting of global L2CAP channels")
Reported-by: syzbot+45ac74737e866894acb0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=45ac74737e866894acb0
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 net/bluetooth/l2cap_core.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index c3c26bbb5dda..9988ba382b68 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6774,6 +6774,7 @@  static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
 	bt_cb(skb)->l2cap.psm = psm;
 
 	if (!chan->ops->recv(chan, skb)) {
+		l2cap_chan_unlock(chan);
 		l2cap_chan_put(chan);
 		return;
 	}