Re: [syzbot] [bluetooth?] general protection fault in l2cap_sock_recv_cb

Hillf Danton
2024-06-22T08:24:55Z

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git cc8ed4d0a848

--- x/net/bluetooth/l2cap_core.c
+++ y/net/bluetooth/l2cap_core.c
@@ -6756,6 +6756,7 @@ static void l2cap_conless_channel(struct
{
struct hci_conn *hcon = conn->hcon;
struct l2cap_chan *chan;
+ int rc;

if (hcon->type != ACL_LINK)
goto free_skb;
@@ -6767,6 +6768,8 @@ static void l2cap_conless_channel(struct

BT_DBG("chan %p, len %d", chan, skb->len);

+ l2cap_chan_lock(chan);
+
if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
goto drop;

@@ -6777,15 +6780,15 @@ static void l2cap_conless_channel(struct
bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
bt_cb(skb)->l2cap.psm = psm;

- if (!chan->ops->recv(chan, skb)) {
- l2cap_chan_put(chan);
- return;
- }
+ rc = chan->ops->recv(chan, skb);

drop:
+ l2cap_chan_unlock(chan);
l2cap_chan_put(chan);
+ if (rc) {
free_skb:
- kfree_skb(skb);
+ kfree_skb(skb);
+ }
}

static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
--- x/net/bluetooth/l2cap_sock.c
+++ y/net/bluetooth/l2cap_sock.c
@@ -1237,6 +1237,7 @@ static void l2cap_sock_kill(struct sock
if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
return;

+ l2cap_pi(sk)->chan->data = NULL;
BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));

/* Kill poor orphan */
@@ -1481,11 +1482,16 @@ static struct l2cap_chan *l2cap_sock_new

static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
{
- struct sock *sk = chan->data;
- struct l2cap_pinfo *pi = l2cap_pi(sk);
+ struct sock *sk;
+ struct l2cap_pinfo *pi;
int err;

+ if (!chan->data)
+ return -ENXIO;
+
+ sk = chan->data;
lock_sock(sk);
+ pi = l2cap_pi(sk);

if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
err = -ENOMEM;
--