Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp

If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and
in fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected.

Calling l2cap_chan_clone directly may still lead to l2cap_chan_del so
instead schedule l2cap_chan_timeout with delay 0 to close the channel
asynchronously.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index ff13c43e3588cde9c9afcdedc56e0e313d6eaa81..45b175399e8dbbfd5c2c3adee79628e6b4ab5121 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5262,6 +5262,7 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
        cmd_len -= sizeof(*rsp);
 
        list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
+               struct l2cap_chan *orig;
                u16 dcid;
 
                if (chan->ident != cmd->ident ||
@@ -5283,8 +5284,10 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
 
                BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
 
+               orig = __l2cap_get_chan_by_dcid(conn, dcid);
+
                /* Check if dcid is already in use */
-               if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
+               if (dcid && orig) {
                        /* If a device receives a
                         * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
                         * already-assigned Destination CID, then both the
@@ -5293,10 +5296,24 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
                         */
                        l2cap_chan_del(chan, ECONNREFUSED);
                        l2cap_chan_unlock(chan);
-                       chan = __l2cap_get_chan_by_dcid(conn, dcid);
-                       l2cap_chan_lock(chan);
-                       l2cap_chan_del(chan, ECONNRESET);
-                       l2cap_chan_unlock(chan);
+
+                       /* Check that the dcid channel mode is
+                        * L2CAP_MODE_EXT_FLOWCTL since this procedure is only
+                        * valid for that mode and shouldn't disconnect a dcid
+                        * in other modes.
+                        */
+                       if (orig->mode == L2CAP_MODE_EXT_FLOWCTL) {
+                               l2cap_chan_lock(orig);
+                               /* Disconnect the original channel as it may be
+                                * considered connected since dcid has already
+                                * been assigned; don't call l2cap_chan_close
+                                * directly since that could lead to
+                                * l2cap_chan_del and then removing the channel
+                                * from the list while we're iterating over it.
+                                */
+                               __set_chan_timer(orig, 0);
+                               l2cap_chan_unlock(orig);
+                       }
                        continue;
                }