Bluetooth: __l2cap_wait_ack() add defensive timeout

Add a timeout to prevent the do while loop running in an
infinite loop. This ensures that the channel will be
instructed to close within 10 seconds so prevents
l2cap_sock_shutdown() getting stuck forever.

Returns -ENOLINK when the timeout is reached. The channel
will be subequently closed and not all data will be ACK'ed.

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 10 insertions, 1 deletions

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index f0b052a75e8a..586b3d580cfc 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1059,11 +1059,15 @@ static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
         DECLARE_WAITQUEUE(wait, current);
         int err = 0;
         int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
+        /* Timeout to prevent infinite loop */
+        unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
 
         add_wait_queue(sk_sleep(sk), &wait);
         set_current_state(TASK_INTERRUPTIBLE);
         do {
-                BT_DBG("Waiting for %d ACKs", chan->unacked_frames);
+                BT_DBG("Waiting for %d ACKs, timeout %04d ms",
+                       chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
+                       jiffies_to_msecs(timeout - jiffies));
 
                 if (!timeo)
                         timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
@@ -1082,6 +1086,11 @@ static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
                 if (err)
                         break;
 
+                if (time_after(jiffies, timeout)) {
+                        err = -ENOLINK;
+                        break;
+                }
+
         } while (chan->unacked_frames > 0 &&
                  chan->state == BT_CONNECTED);