• Dean Jenkins's avatar
    Bluetooth: Handle bt_accept_enqueue() socket atomically · e1633762
    Dean Jenkins authored
    There is a small risk that bt_accept_unlink() runs concurrently with
    bt_accept_enqueue() on the same socket. This scenario could potentially
    lead to a NULL pointer dereference of the socket's parent member because
    the socket can be on the list but the socket's parent member is not yet
    updated by bt_accept_enqueue().
    
    Therefore, add socket locking inside bt_accept_enqueue() so that the
    socket is added to the list AND the parent's socket address is set in the
    socket's parent member. The socket locking ensures that the socket is on
    the list with a valid non-NULL parent member.
    Signed-off-by: default avatarDean Jenkins <Dean_Jenkins@mentor.com>
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    e1633762
af_bluetooth.c 16.9 KB