[PATCH v5 3/3] Bluetooth: L2CAP: Fix allowing to change security multiple times

[Luiz Augusto von Dentz <luiz.dentz@gmail.com>]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

If FLAG_PENDING_SECURITY is already set it means SMP pairing process
is in progress and hcon->pending_sec_level shouldn't be changed since it
may require to change pairing requirements (MITM), which may not be
supported depending on stage of the pairing procedure, and
may result in a security level that don't match with the pairing keys
authentication (e.g. upgrading to BT_SECURITY_HIGH without setting
MITM requirements).

To fix tis problem the code will now return -EINPROGRESS if a process
call setsockopt(BT_SECURITY) and set FLAG_PENDING_SECURITY it needs to
await the socket to resume and clear the flag before it can update the
security level again.

Fixes: bbb69b37be15 ("Bluetooth: Add return check for L2CAP security level set")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
v5: New patch to address comments on:
https://sashiko.dev/#/patchset/bt-smp-v4-ea63d24bfcd1416f9da279190fab15fc%401seal.org?patch=14763

 net/bluetooth/l2cap_sock.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 71e8c1b45bce..786ca7c6e272 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -929,6 +929,15 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 
 		/* change security for LE channels */
 		if (chan->scid == L2CAP_CID_ATT) {
+			/* If security already pending, return error to avoid
+			 * changing the pending_sec_level while the pairing
+			 * procedure is still ongoing.
+			 */
+			if (test_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
+				err = -EINPROGRESS;
+				break;
+			}
+
 			if (smp_conn_security(conn->hcon, sec.level)) {
 				err = -EINVAL;
 				break;
-- 
2.53.0