Commit 41c2713b authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp 



If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and
in fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected.

Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so
instead schedule l2cap_chan_timeout with delay 0 to close the channel
asynchronously.

Fixes: 15f02b91 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 00e19507

net/bluetooth/l2cap_core.c

+22 −5
Original line number Diff line number Diff line
@@ -5262,6 +5262,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 
	cmd_len -= sizeof(*rsp);



	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {

		struct l2cap_chan *orig;

		u16 dcid;



		if (chan->ident != cmd->ident ||
@@ -5283,8 +5284,10 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 


		BT_DBG("dcid[%d] 0x%4.4x", i, dcid);



		orig = __l2cap_get_chan_by_dcid(conn, dcid);



		/* Check if dcid is already in use */

		if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {

		if (dcid && orig) {

			/* If a device receives a

			 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an

			 * already-assigned Destination CID, then both the
@@ -5293,10 +5296,24 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 
			 */

			l2cap_chan_del(chan, ECONNREFUSED);

			l2cap_chan_unlock(chan);

			chan = __l2cap_get_chan_by_dcid(conn, dcid);

			l2cap_chan_lock(chan);

			l2cap_chan_del(chan, ECONNRESET);

			l2cap_chan_unlock(chan);



			/* Check that the dcid channel mode is

			 * L2CAP_MODE_EXT_FLOWCTL since this procedure is only

			 * valid for that mode and shouldn't disconnect a dcid

			 * in other modes.

			 */

			if (orig->mode == L2CAP_MODE_EXT_FLOWCTL) {

				l2cap_chan_lock(orig);

				/* Disconnect the original channel as it may be

				 * considered connected since dcid has already

				 * been assigned; don't call l2cap_chan_close

				 * directly since that could lead to

				 * l2cap_chan_del and then removing the channel

				 * from the list while we're iterating over it.

				 */

				__set_chan_timer(orig, 0);

				l2cap_chan_unlock(orig);

			}

			continue;

		}