hc
2024-12-19 9370bb92b2d16684ee45cf24e879c93c509162da
kernel/net/bluetooth/l2cap_sock.c
....@@ -45,6 +45,7 @@
4545 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
4646 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
4747 int proto, gfp_t prio, int kern);
48
+static void l2cap_sock_cleanup_listen(struct sock *parent);
4849
4950 bool l2cap_is_socket(struct socket *sock)
5051 {
....@@ -1414,6 +1415,7 @@
14141415 if (!sk)
14151416 return 0;
14161417
1418
+ l2cap_sock_cleanup_listen(sk);
14171419 bt_sock_unlink(&l2cap_sk_list, sk);
14181420
14191421 err = l2cap_sock_shutdown(sock, SHUT_RDWR);
....@@ -1623,6 +1625,14 @@
16231625 if (!skb)
16241626 return ERR_PTR(err);
16251627
1628
+ /* Channel lock is released before requesting new skb and then
1629
+ * reacquired thus we need to recheck channel state.
1630
+ */
1631
+ if (chan->state != BT_CONNECTED) {
1632
+ kfree_skb(skb);
1633
+ return ERR_PTR(-ENOTCONN);
1634
+ }
1635
+
16261636 skb->priority = sk->sk_priority;
16271637
16281638 bt_cb(skb)->l2cap.chan = chan;