[PATCH bluetooth-next] Bluetooth: L2CAP: fix list corruption in l2cap_ecred_conn_rsp

[Zhenghang Xiao <kipreyyy@gmail.com>]

The duplicate DCID handling in l2cap_ecred_conn_rsp() calls
l2cap_chan_del() on the channel found by __l2cap_get_chan_by_dcid(),
which may be the 'tmp' pointer of the enclosing
list_for_each_entry_safe loop. list_del() poisons tmp->list.next with
LIST_POISON1, and the next iteration dereferences it:

  KASAN: wild-memory-access in range [0xdead000000000100-0xdead000000000107]
  pc : l2cap_recv_frame+0x3b7c/0x7360

Break out of the loop after the duplicate handling to avoid iterating
with the corrupted pointer. Remaining pending channels for the same
ident are not processed; they will time out via the standard L2CAP
channel timeout since the response indicates a misbehaving peer. Add a
NULL check on the second __l2cap_get_chan_by_dcid() call for robustness.

Fixes: 15f02b910562 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
---
 net/bluetooth/l2cap_core.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 7701528f1167..3456d741fb1c 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5292,10 +5292,12 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
 			l2cap_chan_del(chan, ECONNREFUSED);
 			l2cap_chan_unlock(chan);
 			chan = __l2cap_get_chan_by_dcid(conn, dcid);
-			l2cap_chan_lock(chan);
-			l2cap_chan_del(chan, ECONNRESET);
-			l2cap_chan_unlock(chan);
-			continue;
+			if (chan) {
+				l2cap_chan_lock(chan);
+				l2cap_chan_del(chan, ECONNRESET);
+				l2cap_chan_unlock(chan);
+			}
+			break;
 		}
 
 		switch (result) {
-- 
2.50.1 (Apple Git-155)