[PATCH v1] Bluetooth: 6lowpan: Always consume the skb in chan_recv_cb

[PATCH v1] Bluetooth: 6lowpan: Always consume the skb in chan_recv_cb

[Luiz Augusto von Dentz]

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

The l2cap_chan_ops recv callback takes ownership of the skb on success and
leaves it to the caller on failure.  chan_recv_cb() violates this: when
recv_pkt() fails it returns -EAGAIN even though skb_share_check() may
already have dropped the caller's reference to a shared skb and replaced
it with a clone.  The L2CAP caller then calls kfree_skb() on the original
skb, over-releasing it, while the clone is leaked.

Make recv_pkt() free the skb on its drop path and have chan_recv_cb()
always consume the skb and return 0, including the lookup failures, so the
caller never frees it again.  A dropped packet is accounted in rx_dropped
and no longer reported as a receive error to L2CAP.

Fixes: 11e3ff707278 ("6lowpan: Use skb_cow in IPHC decompression.")
Assisted-by: OpenCode:claude-sonnet-5.5
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
 net/bluetooth/6lowpan.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 8c51c20f6c4b..68ca2f49dadc 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -345,6 +345,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 	return NET_RX_SUCCESS;
 
 drop:
+	kfree_skb(skb);
 	dev->stats.rx_dropped++;
 	return NET_RX_DROP;
 }
@@ -356,21 +357,26 @@ static int chan_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 	struct lowpan_peer *peer;
 	int err;
 
+	/* The skb is always consumed, so never return an error that would
+	 * make the caller free it again.
+	 */
 	peer = lookup_peer(chan->conn);
 	if (!peer)
-		return -ENOENT;
+		goto drop;
 
 	dev = lookup_dev(chan->conn);
 	if (!dev || !dev->netdev)
-		return -ENOENT;
+		goto drop;
 
 	err = recv_pkt(skb, dev->netdev, peer);
-	if (err) {
+	if (err)
 		BT_DBG("recv pkt %d", err);
-		err = -EAGAIN;
-	}
 
-	return err;
+	return 0;
+
+drop:
+	kfree_skb(skb);
+	return 0;
 }
 
 static int setup_header(struct sk_buff *skb, struct net_device *netdev,
-- 
2.56.0

RE: [v1] Bluetooth: 6lowpan: Always consume the skb in chan_recv_cb

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1929 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1210747/

---Test result---

Test Summary:
CheckPatch                    FAIL      0.40 seconds
VerifyFixes                   PASS      0.05 seconds
VerifySignedoff               PASS      0.05 seconds
GitLint                       PASS      0.16 seconds
SubjectPrefix                 PASS      0.05 seconds
BuildKernel                   PASS      20.24 seconds
CheckAllWarning               PASS      23.06 seconds
CheckSparse                   PASS      24.22 seconds
BuildKernel32                 PASS      20.21 seconds
CheckKernelLLVM               PASS      21.68 seconds
TestRunnerSetup               PASS      474.74 seconds
TestRunner_6lowpan-tester     PASS      5.06 seconds
IncrementalBuild              PASS      18.69 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v1] Bluetooth: 6lowpan: Always consume the skb in chan_recv_cb
WARNING: Non-standard signature: Assisted-by:
#130: 
Assisted-by: OpenCode:claude-sonnet-5.5

ERROR: Unrecognized email address: 'OpenCode:claude-sonnet-5.5'
#130: 
Assisted-by: OpenCode:claude-sonnet-5.5

total: 1 errors, 1 warnings, 0 checks, 39 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/home/runner/work/bluetooth-next/bluetooth-next/src/patch/14980523.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.




https://github.com/bluez/bluetooth-next/pull/1131

---
Regards,
Linux Bluetooth