Skip to content

Commit a6a5568

Browse files
Mat MartineauGustavo Padovan
Mat Martineau
authored and
Gustavo Padovan
committed
Bluetooth: Lock the L2CAP channel when sending
The ERTM and streaming mode transmit queue must only be accessed while the L2CAP channel lock is held. Locking the channel before calling l2cap_chan_send ensures that multiple threads cannot simultaneously manipulate the queue when sending and receiving concurrently. L2CAP channel locking had previously moved to the l2cap_chan struct instead of the associated socket, so some of the old socket locking can also be removed in this patch. Signed-off-by: Mat Martineau <[email protected]> Signed-off-by: Gustavo Padovan <[email protected]>
1 parent ef191ad commit a6a5568

File tree

2 files changed

+6
-8
lines changed

2 files changed

+6
-8
lines changed

include/net/bluetooth/bluetooth.h

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,12 +257,10 @@ static inline struct sk_buff *bt_skb_send_alloc(struct sock *sk,
257257
{
258258
struct sk_buff *skb;
259259

260-
release_sock(sk);
261260
if ((skb = sock_alloc_send_skb(sk, len + BT_SKB_RESERVE, nb, err))) {
262261
skb_reserve(skb, BT_SKB_RESERVE);
263262
bt_cb(skb)->incoming = 0;
264263
}
265-
lock_sock(sk);
266264

267265
if (!skb && *err)
268266
return NULL;

net/bluetooth/l2cap_sock.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -720,16 +720,13 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
720720
if (msg->msg_flags & MSG_OOB)
721721
return -EOPNOTSUPP;
722722

723-
lock_sock(sk);
724-
725-
if (sk->sk_state != BT_CONNECTED) {
726-
release_sock(sk);
723+
if (sk->sk_state != BT_CONNECTED)
727724
return -ENOTCONN;
728-
}
729725

726+
l2cap_chan_lock(chan);
730727
err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
728+
l2cap_chan_unlock(chan);
731729

732-
release_sock(sk);
733730
return err;
734731
}
735732

@@ -940,7 +937,10 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
940937
struct sk_buff *skb;
941938
int err;
942939

940+
l2cap_chan_unlock(chan);
943941
skb = bt_skb_send_alloc(chan->sk, len, nb, &err);
942+
l2cap_chan_lock(chan);
943+
944944
if (!skb)
945945
return ERR_PTR(err);
946946

0 commit comments

Comments
 (0)