Bluetooth: L2CAP ERTM shutdown protect sk and chan

During execution of l2cap_sock_shutdown() which might
sleep, the sk and chan structures can be in an unlocked
condition which potentially allows the structures to be
freed by other running threads. Therefore, there is a
possibility of a malfunction or memory reuse after being
freed.

Keep the sk and chan structures alive during the
execution of l2cap_sock_shutdown() by using their
respective hold and put functions. This allows the structures
to be freeable at the end of l2cap_sock_shutdown().

Signed-off-by: Kautuk Consul <Kautuk_Consul@mentor.com>
Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 8 insertions, 0 deletions

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 244287706f91..3794c2386c21 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1098,7 +1098,12 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
         if (!sk)
                 return 0;
 
+        /* prevent sk structure from being freed whilst unlocked */
+        sock_hold(sk);
+
         chan = l2cap_pi(sk)->chan;
+        /* prevent chan structure from being freed whilst unlocked */
+        l2cap_chan_hold(chan);
         conn = chan->conn;
 
         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
@@ -1134,6 +1139,9 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
         if (conn)
                 mutex_unlock(&conn->chan_lock);
 
+        l2cap_chan_put(chan);
+        sock_put(sk);
+
         return err;
 }