From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3B63238E8B9; Mon, 17 Aug 2026 14:19:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786976398; cv=none; b=HfFb54NcITqFZ5AKH2zofnozxEibiFJuZ8Qm0zYcAKMi1kPA7ZXQ8OfXvb4CQSELTiFrfFYB7cAQHpf+Gs49/s+JzrJ9Q6jamyrM7wrBDsSvrcG5WxhwLM85vg0X2GkTHGEXS0vpOwFyqPsQIdnJjvlVZLQBEUg/u0Xdw+UCsvE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786976398; c=relaxed/simple; bh=XqespWoR97JsvTcmpI3c8CjqpjmMx8385dgQTOFl2DQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ZabT4S388pmzAx8/j0fMW/jgWoHBYYnk0dWtuMbGpFZgXzGG9X/8vy2F0qqqHHHr5Q7ny+qSzvPK0X36i4+iW2XtnSlGy7bGBz3JaMEcX6PXlfyVA1aSVNB9WPw3g+SJDWn1YexI4+fsfmkIMVepBVRRVEH2l31ad/SSKbGF7cg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=AyrEDKpr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="AyrEDKpr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 92FFB1F000E9; Mon, 17 Aug 2026 14:19:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786976397; bh=b5dADyV6jkU47vaNttLEihKTA8IsQWQZ/5f88dbErGU=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=AyrEDKprBrn5KiCaUD1PrybeJiGU1Ls0Ffc/ksvnqrY92McrsiJMBJF/Oo1drz347 QNrDFqBonSeH7ZAIdXqIuEF5A1ciiN43nxLaVKnJGG3wf+RCE3J1HiULZVI7q29baR Dwg43Tv98dh/BModU5E+jdIrnFGyj2XrRJpPX9XU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Luiz Augusto von Dentz , Sasha Levin Subject: [PATCH 5.10 358/389] Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Date: Mon, 17 Aug 2026 15:33:17 +0200 Message-ID: <20260817132552.717810066@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132538.796021292@linuxfoundation.org> References: <20260817132538.796021292@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Luiz Augusto von Dentz [ Upstream commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 ] b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") don't reset the chan->conn to NULL anymore making the bt# netdev not be remove once the last l2cap_chan_del is removed. Instead of restoring the original behavior this remove the logic of keeping the interface after the last channel is removed because it never worked as intended and the l2cap_chan_del always detach its l2cap_conn which results in always removing the channel anyway. Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin --- net/bluetooth/6lowpan.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 096f6fc5d30bf..a71855268d33f 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -804,20 +804,10 @@ static void chan_close_cb(struct l2cap_chan *chan) struct lowpan_btle_dev *dev = NULL; struct lowpan_peer *peer; int err = -ENOENT; - bool last = false, remove = true; + bool last = false; BT_DBG("chan %p conn %p", chan, chan->conn); - if (chan->conn && chan->conn->hcon) { - if (!is_bt_6lowpan(chan->conn->hcon)) - return; - - /* If conn is set, then the netdev is also there and we should - * not remove it. - */ - remove = false; - } - spin_lock(&devices_lock); list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { @@ -844,10 +834,8 @@ static void chan_close_cb(struct l2cap_chan *chan) ifdown(dev->netdev); - if (remove) { - INIT_WORK(&entry->delete_netdev, delete_netdev); - schedule_work(&entry->delete_netdev); - } + INIT_WORK(&entry->delete_netdev, delete_netdev); + schedule_work(&entry->delete_netdev); } else { spin_unlock(&devices_lock); } -- 2.53.0