[bug report] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put

[bug report] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put

[Dan Carpenter]

Hello Luiz Augusto von Dentz,

The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused
by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch
static checker warning:

	net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
	error: we previously assumed 'c' could be null (see line 1996)

net/bluetooth/l2cap_core.c
    1968 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
    1969                                                    bdaddr_t *src,
    1970                                                    bdaddr_t *dst,
    1971                                                    u8 link_type)
    1972 {
    1973         struct l2cap_chan *c, *c1 = NULL;
    1974 
    1975         read_lock(&chan_list_lock);
    1976 
--> 1977         list_for_each_entry(c, &chan_list, global_l) {
    1978                 if (state && c->state != state)
    1979                         continue;
    1980 
    1981                 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
    1982                         continue;
    1983 
    1984                 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
    1985                         continue;
    1986 
    1987                 if (c->psm == psm) {
    1988                         int src_match, dst_match;
    1989                         int src_any, dst_any;
    1990 
    1991                         /* Exact match. */
    1992                         src_match = !bacmp(&c->src, src);
    1993                         dst_match = !bacmp(&c->dst, dst);
    1994                         if (src_match && dst_match) {
    1995                                 c = l2cap_chan_hold_unless_zero(c);
    1996                                 if (!c)
    1997                                         continue;

If "c" is NULL then this will crash on the continue statement.  Should
it be list_for_each_entry_safe()?

    1998 
    1999                                 read_unlock(&chan_list_lock);
    2000                                 return c;
    2001                         }
    2002 
    2003                         /* Closest match */
    2004                         src_any = !bacmp(&c->src, BDADDR_ANY);
    2005                         dst_any = !bacmp(&c->dst, BDADDR_ANY);
    2006                         if ((src_match && dst_any) || (src_any && dst_match) ||
    2007                             (src_any && dst_any))
    2008                                 c1 = c;
    2009                 }
    2010         }
    2011 
    2012         if (c1)
    2013                 c1 = l2cap_chan_hold_unless_zero(c1);
    2014 
    2015         read_unlock(&chan_list_lock);
    2016 
    2017         return c1;
    2018 }

regards,
dan carpenter