| From 71811cac8532b2387b3414f7cd8fe9e497482864 Mon Sep 17 00:00:00 2001 |
| From: Qiujun Huang <hqjagain@gmail.com> |
| Date: Sun, 8 Mar 2020 17:45:27 +0800 |
| Subject: Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl |
| |
| From: Qiujun Huang <hqjagain@gmail.com> |
| |
| commit 71811cac8532b2387b3414f7cd8fe9e497482864 upstream. |
| |
| Needn't call 'rfcomm_dlc_put' here, because 'rfcomm_dlc_exists' didn't |
| increase dlc->refcnt. |
| |
| Reported-by: syzbot+4496e82090657320efc6@syzkaller.appspotmail.com |
| Signed-off-by: Qiujun Huang <hqjagain@gmail.com> |
| Suggested-by: Hillf Danton <hdanton@sina.com> |
| Signed-off-by: Marcel Holtmann <marcel@holtmann.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/bluetooth/rfcomm/tty.c | 4 +--- |
| 1 file changed, 1 insertion(+), 3 deletions(-) |
| |
| --- a/net/bluetooth/rfcomm/tty.c |
| +++ b/net/bluetooth/rfcomm/tty.c |
| @@ -413,10 +413,8 @@ static int __rfcomm_create_dev(struct so |
| dlc = rfcomm_dlc_exists(&req.src, &req.dst, req.channel); |
| if (IS_ERR(dlc)) |
| return PTR_ERR(dlc); |
| - else if (dlc) { |
| - rfcomm_dlc_put(dlc); |
| + if (dlc) |
| return -EBUSY; |
| - } |
| dlc = rfcomm_dlc_alloc(GFP_KERNEL); |
| if (!dlc) |
| return -ENOMEM; |
