Commit 2baea85d authored Jun 23, 2015 by Dean Jenkins Committed by Marcel Holtmann Jul 23, 2015

Bluetooth: L2CAP ERTM shutdown protect sk and chan



During execution of l2cap_sock_shutdown() which might
sleep, the sk and chan structures can be in an unlocked
condition which potentially allows the structures to be
freed by other running threads. Therefore, there is a
possibility of a malfunction or memory reuse after being
freed.

Keep the sk and chan structures alive during the
execution of l2cap_sock_shutdown() by using their
respective hold and put functions. This allows the structures
to be freeable at the end of l2cap_sock_shutdown().

Signed-off-by: Kautuk Consul <Kautuk_Consul@mentor.com>
Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

parent d10270ce

net/bluetooth/l2cap_sock.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -1098,7 +1098,12 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
		if (!sk)
		return 0;

		/* prevent sk structure from being freed whilst unlocked */
		sock_hold(sk);

		chan = l2cap_pi(sk)->chan;
		/* prevent chan structure from being freed whilst unlocked */
		l2cap_chan_hold(chan);
		conn = chan->conn;

		BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
		@@ -1134,6 +1139,9 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
		if (conn)
		mutex_unlock(&conn->chan_lock);

		l2cap_chan_put(chan);
		sock_put(sk);

		return err;
		}