Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel

commit f19425641cb2572a33cb074d5e30283720bd4d22 upstream.

Only sockets will have the chan->data set to an actual sk, channels
like A2MP would have its own data which would likely cause a crash when
calling sk_filter, in order to fix this a new callback has been
introduced so channels can implement their own filtering if necessary.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/bluetooth/l2cap.h b/include/net/bluetooth/l2cap.h
index 8f1e6a7a2df84aa9231177c3af74da408710feaf..1d1232917de72080167747e45d8d8834e9a59b91 100644 (file)
--- a/include/net/bluetooth/l2cap.h
+++ b/include/net/bluetooth/l2cap.h
@@ -665,6 +665,8 @@ struct l2cap_ops {
        struct sk_buff          *(*alloc_skb) (struct l2cap_chan *chan,
                                               unsigned long hdr_len,
                                               unsigned long len, int nb);
+       int                     (*filter) (struct l2cap_chan * chan,
+                                          struct sk_buff *skb);
 };
 
 struct l2cap_conn {

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fe913a5c754a80b8ceef963fa829c566314cb8ea..129cbef8e5605cb21df9e75b84b0c6ad9d569b9c 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7302,9 +7302,10 @@ static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
                goto drop;
        }
 
-       if ((chan->mode == L2CAP_MODE_ERTM ||
-            chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb))
-               goto drop;
+       if (chan->ops->filter) {
+               if (chan->ops->filter(chan, skb))
+                       goto drop;
+       }
 
        if (!control->sframe) {
                int err;

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index a995d2c51fa7f1728986de2b7fb08f0fbe1efcfc..c7fc28a465fdb69164c6d3a420433213b1bd662d 100644 (file)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1663,6 +1663,19 @@ static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
        sk->sk_state_change(sk);
 }
 
+static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
+{
+       struct sock *sk = chan->data;
+
+       switch (chan->mode) {
+       case L2CAP_MODE_ERTM:
+       case L2CAP_MODE_STREAMING:
+               return sk_filter(sk, skb);
+       }
+
+       return 0;
+}
+
 static const struct l2cap_ops l2cap_chan_ops = {
        .name                   = "L2CAP Socket Interface",
        .new_connection         = l2cap_sock_new_connection_cb,
@@ -1678,6 +1691,7 @@ static const struct l2cap_ops l2cap_chan_ops = {
        .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
        .get_peer_pid           = l2cap_sock_get_peer_pid_cb,
        .alloc_skb              = l2cap_sock_alloc_skb_cb,
+       .filter                 = l2cap_sock_filter,
 };
 
 static void l2cap_sock_destruct(struct sock *sk)