github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

Browse Source 
If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and
in fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected.

Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so
instead schedule l2cap_chan_timeout with delay 0 to close the channel
asynchronously.

Fixes: 15f02b9105 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Luiz Augusto von Dentz 2026-05-11 12:09:42 -04:00
parent 00e1950716
commit 41c2713b20
1 changed files with 22 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
net/bluetooth/l2cap_core.c
View File

@ -5262,6 +5262,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
cmd_len -= sizeof(*rsp); cmd_len -= sizeof(*rsp);
list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
struct l2cap_chan *orig;
u16 dcid; u16 dcid;
if (chan->ident != cmd->ident || if (chan->ident != cmd->ident ||
@ -5283,8 +5284,10 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
BT_DBG("dcid[%d] 0x%4.4x", i, dcid); BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
orig = __l2cap_get_chan_by_dcid(conn, dcid);
/* Check if dcid is already in use */ /* Check if dcid is already in use */
if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) { if (dcid && orig) {
/* If a device receives a /* If a device receives a
* L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
* already-assigned Destination CID, then both the * already-assigned Destination CID, then both the
@ -5293,10 +5296,24 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
*/ */
l2cap_chan_del(chan, ECONNREFUSED); l2cap_chan_del(chan, ECONNREFUSED);
l2cap_chan_unlock(chan); l2cap_chan_unlock(chan);
chan = __l2cap_get_chan_by_dcid(conn, dcid);
l2cap_chan_lock(chan); /* Check that the dcid channel mode is
l2cap_chan_del(chan, ECONNRESET); * L2CAP_MODE_EXT_FLOWCTL since this procedure is only
l2cap_chan_unlock(chan); * valid for that mode and shouldn't disconnect a dcid
* in other modes.
*/
if (orig->mode == L2CAP_MODE_EXT_FLOWCTL) {
l2cap_chan_lock(orig);
/* Disconnect the original channel as it may be
* considered connected since dcid has already
* been assigned; don't call l2cap_chan_close
* directly since that could lead to
* l2cap_chan_del and then removing the channel
* from the list while we're iterating over it.
*/
__set_chan_timer(orig, 0);
l2cap_chan_unlock(orig);
}
continue; continue;
} }