Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn  l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup.  There is a TOCTOU race where the invariant is violated:      [Task 1]                          [Task 2]     l2cap_chan_connect                l2cap_sock_bind       l2cap_chan_lock                   lock_sock       l2cap_state_change                if (sk->sk_state != BT_OPEN)         chan->state = BT_CONNECT         l2cap_sock_state_change_cb      chan->state = BT_BOUND                                         sk->sk_state = BT_BOUND           lock_sock <------------------ release_sock           sk->sk_state = BT_CONNECT  l2cap_sock_connect() does not check sk->sk_state, so since chan->state is now BT_BOUND, subsequent connect() ends up with second __l2cap_chan_add.  Explicitly document and check the invariant in __l2cap_chan_add with WARN_ON_ONCE. The only callsite where it could be hit is l2cap_chan_connect, so add pre-check there to avoid relying on chan->state. chan->state read/write is not properly guarded currently so there can be other TOCTOUC problems.  Add l2cap_lock_chan in l2cap_sock_bind() to guard chan->state write.