]> www.infradead.org Git - users/willy/pagecache.git/commit
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
authorLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Wed, 4 Dec 2024 16:40:59 +0000 (11:40 -0500)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Thu, 12 Dec 2024 14:23:49 +0000 (09:23 -0500)
commit581dd2dc168fe0ed2a7a5534a724f0d3751c93ae
tree074ddd939c6dae6e1aba5a2f599fdfab1272ed72
parent4d94f05558271654670d18c26c912da0c1c15549
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating

The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is
not safe since for the most part entries fetched this way shall be
treated as rcu_dereference:

Note that the value returned by rcu_dereference() is valid
only within the enclosing RCU read-side critical section [1]_.
For example, the following is **not** legal::

rcu_read_lock();
p = rcu_dereference(head.next);
rcu_read_unlock();
x = p->address; /* BUG!!! */
rcu_read_lock();
y = p->data; /* BUG!!! */
rcu_read_unlock();

Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_event.c