Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression

commit 332f1795ca202489c665a75e62e18ff6284de077 upstream.

The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused
by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch
static checker warning:

        net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
        error: we previously assumed 'c' could be null (see line 1996)

Fixes: d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 780073f..a0e0c2b 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1970,11 +1970,11 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
                                                   bdaddr_t *dst,
                                                   u8 link_type)
 {
-       struct l2cap_chan *c, *c1 = NULL;
+       struct l2cap_chan *c, *tmp, *c1 = NULL;
 
        read_lock(&chan_list_lock);
 
-       list_for_each_entry(c, &chan_list, global_l) {
+       list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
                if (state && c->state != state)
                        continue;
 
@@ -1993,11 +1993,10 @@ static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
                        dst_match = !bacmp(&c->dst, dst);
                        if (src_match && dst_match) {
                                c = l2cap_chan_hold_unless_zero(c);
-                               if (!c)
-                                       continue;
-
-                               read_unlock(&chan_list_lock);
-                               return c;
+                               if (c) {
+                                       read_unlock(&chan_list_lock);
+                                       return c;
+                               }
                        }
 
                        /* Closest match */