write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/net/bluetooth/l2cap_sock.c
..
..
@@ -45,6 +45,7 @@
45
45
 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
46
46
 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
47
47
 				     int proto, gfp_t prio, int kern);
48
+static void l2cap_sock_cleanup_listen(struct sock *parent);
48
49
 
49
50
 bool l2cap_is_socket(struct socket *sock)
50
51
 {
..
..
@@ -1414,6 +1415,7 @@
1414
1415
 	if (!sk)
1415
1416
 		return 0;
1416
1417
 
1418
+	l2cap_sock_cleanup_listen(sk);
1417
1419
 	bt_sock_unlink(&l2cap_sk_list, sk);
1418
1420
 
1419
1421
 	err = l2cap_sock_shutdown(sock, SHUT_RDWR);
..
..
@@ -1623,6 +1625,14 @@
1623
1625
 	if (!skb)
1624
1626
 		return ERR_PTR(err);
1625
1627
 
1628
+	/* Channel lock is released before requesting new skb and then
1629
+	 * reacquired thus we need to recheck channel state.
1630
+	 */
1631
+	if (chan->state != BT_CONNECTED) {
1632
+		kfree_skb(skb);
1633
+		return ERR_PTR(-ENOTCONN);
1634
+	}
1635
+
1626
1636
 	skb->priority = sk->sk_priority;
1627
1637
 
1628
1638
 	bt_cb(skb)->l2cap.chan = chan;