From: Luiz Augusto von Dentz Date: Mon, 1 Aug 2022 20:52:07 +0000 (-0700) Subject: Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression X-Git-Tag: baikal/mips/sdk5.9~6 X-Git-Url: https://git.baikalelectronics.ru/sdk/?a=commitdiff_plain;h=1630d579c1a20418c5d14cbf69d1dfb32b52ba8a;p=kernel.git Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression commit dc929a9c23d1159b808e3fb8dd7616d81980f280 upstream. The patch 5c507b737a50: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch static checker warning: net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm() error: we previously assumed 'c' could be null (see line 1996) Fixes: 5c507b737a50 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put") Reported-by: Dan Carpenter Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Greg Kroah-Hartman --- diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 780073f6affcb..a0e0c2bdbb49a 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -1970,11 +1970,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *dst, u8 link_type) { - struct l2cap_chan *c, *c1 = NULL; + struct l2cap_chan *c, *tmp, *c1 = NULL; read_lock(&chan_list_lock); - list_for_each_entry(c, &chan_list, global_l) { + list_for_each_entry_safe(c, tmp, &chan_list, global_l) { if (state && c->state != state) continue; @@ -1993,11 +1993,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, dst_match = !bacmp(&c->dst, dst); if (src_match && dst_match) { c = l2cap_chan_hold_unless_zero(c); - if (!c) - continue; - - read_unlock(&chan_list_lock); - return c; + if (c) { + read_unlock(&chan_list_lock); + return c; + } } /* Closest match */