From:   Alexander Coffin <alex.coffin@matician.com>
To:     Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc:     Alexander Coffin <alex.coffin@matician.com>,
        linux-bluetooth@vger.kernel.org
Subject: [PATCH] bluetooth: fix use-after-delete
Date:   Tue, 31 Jan 2023 15:01:05 -0800
Message-Id: <20230131230105.139035-1-alex.coffin@matician.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

the use-after-delete occurs when the bluetooth connection closes while
messages are still being sent.

Signed-off-by: Alexander Coffin <alex.coffin@matician.com>
---
 net/bluetooth/l2cap_core.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a3e0dc6a6e73..6cf5ed9a1a7b 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -2350,6 +2350,10 @@ static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
 					 struct msghdr *msg, int len,
 					 int count, struct sk_buff *skb)
 {
+	/* `conn` may be NULL, or dangling as this is called from some contexts
+	 * where `chan->ops->alloc_skb` was just called, and the connection
+	 * status was not checked afterward.
+	 */
 	struct l2cap_conn *conn = chan->conn;
 	struct sk_buff **frag;
 	int sent = 0;
@@ -2365,6 +2369,13 @@ static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
 	while (len) {
 		struct sk_buff *tmp;
 
+		/* Channel lock is released before requesting new skb and then
+		 * reacquired thus we need to recheck channel state.
+		 * chan->state == BT_CONNECTED implies that conn is still valid.
+		 */
+		if (chan->state != BT_CONNECTED)
+			return -ENOTCONN;
+
 		count = min_t(unsigned int, conn->mtu, len);
 
 		tmp = chan->ops->alloc_skb(chan, 0, count,
-- 
2.30.2