Hi Thadeu, > When cmtp_attach_device fails, cmtp_add_connection returns the error value > which leads to the caller to doing fput through sockfd_put. But > cmtp_session kthread, which is stopped in this path will also call fput, > leading to a potential refcount underflow or a use-after-free. > > Add a refcount before we signal the kthread to stop. The kthread will try > to grab the cmtp_session_sem mutex before doing the fput, which is held > when get_file is called, so there should be no races there. > > Reported-by: Ryota Shiga > Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@xxxxxxxxxxxxx> > --- > net/bluetooth/cmtp/core.c | 5 +++++ > 1 file changed, 5 insertions(+) Patch has been applied to bluetooth-next tree. Regards Marcel
