Bluetooth: L2CAP ERTM shutdown protect sk and chan

During execution of l2cap_sock_shutdown() which might
sleep, the sk and chan structures can be in an unlocked
condition which potentially allows the structures to be
freed by other running threads. Therefore, there is a
possibility of a malfunction or memory reuse after being
freed.

Keep the sk and chan structures alive during the
execution of l2cap_sock_shutdown() by using their
respective hold and put functions. This allows the structures
to be freeable at the end of l2cap_sock_shutdown().

Signed-off-by: Kautuk Consul <Kautuk_Consul@mentor.com>
Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 244287706f910bdaf69afaef98cf2706cd301654..3794c2386c211c7ba934367f5ecc95c1342c87f7 100644 (file)
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1098,7 +1098,12 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
        if (!sk)
                return 0;
 
+       /* prevent sk structure from being freed whilst unlocked */
+       sock_hold(sk);
+
        chan = l2cap_pi(sk)->chan;
+       /* prevent chan structure from being freed whilst unlocked */
+       l2cap_chan_hold(chan);
        conn = chan->conn;
 
        BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
@@ -1134,6 +1139,9 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
        if (conn)
                mutex_unlock(&conn->chan_lock);
 
+       l2cap_chan_put(chan);
+       sock_put(sk);
+
        return err;
 }