From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E18DA4457C5; Mon, 17 Aug 2026 15:25:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786980324; cv=none; b=iKM9yRZl5vYzYvfUmB9Pzt258VQfv99vJ2Og/cClVENBYAxWueAsjD/WqcuUk+FZr4R1T47EpYalut3AMKXUSuhmDbctc/hNDqfPpwyIhqngesUyT6Z9DMy+sHordCTSLpmg3fxdIkn6IVy6wv1vjB1Ks8pulu7mr1geHBdASpc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786980324; c=relaxed/simple; bh=Zn4627DGg2Mk0+Ywmfznaves0rPcQzJQNSnZKmpZf54=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CuPV2TMOETYdPcLSKSSVfR8VGt6YSerXlDjFoAbnS0aD2yxxkub7q6f1L6/Z45Ja7pqICN910PBE1fza4ELmpRNN8kLf/esret8cdpvd4Mpib4samHoSZnITNlxwblmN7/hYLiGfJIyQB/QYuFFBWI601zIViP4ePdD3RwxSb6M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=eUSVPlz8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="eUSVPlz8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42DB51F000E9; Mon, 17 Aug 2026 15:25:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786980322; bh=y8DQhgfMp9A1W8NzhLvmOFHLLmZ/T1iFuxaFTLUfajA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eUSVPlz80to5HriCIxExPp2UfH/ZZzsJSGRoD7+mwE+pUzGYOvIVUHrVR80P3bdD8 fxpo94qdZayCRKSEI/qP0UK3VwU+9NIB2xTtmHjFt+vw4SQr5dTDxHsZ/ZWZ2uC7mJ +RfP6uSryzIHCIv/CReKAI8ACAiS13Se+1EYcdBc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Luiz Augusto von Dentz , Sasha Levin Subject: [PATCH 6.1 484/609] Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev Date: Mon, 17 Aug 2026 15:33:00 +0200 Message-ID: <20260817132600.126038296@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132543.039278408@linuxfoundation.org> References: <20260817132543.039278408@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Luiz Augusto von Dentz [ Upstream commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 ] b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") don't reset the chan->conn to NULL anymore making the bt# netdev not be remove once the last l2cap_chan_del is removed. Instead of restoring the original behavior this remove the logic of keeping the interface after the last channel is removed because it never worked as intended and the l2cap_chan_del always detach its l2cap_conn which results in always removing the channel anyway. Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin --- net/bluetooth/6lowpan.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index e2196cf4f6f70..723ead2c04f16 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -781,20 +781,10 @@ static void chan_close_cb(struct l2cap_chan *chan) struct lowpan_btle_dev *dev = NULL; struct lowpan_peer *peer; int err = -ENOENT; - bool last = false, remove = true; + bool last = false; BT_DBG("chan %p conn %p", chan, chan->conn); - if (chan->conn && chan->conn->hcon) { - if (!is_bt_6lowpan(chan->conn->hcon)) - return; - - /* If conn is set, then the netdev is also there and we should - * not remove it. - */ - remove = false; - } - spin_lock(&devices_lock); list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { @@ -821,10 +811,8 @@ static void chan_close_cb(struct l2cap_chan *chan) ifdown(dev->netdev); - if (remove) { - INIT_WORK(&entry->delete_netdev, delete_netdev); - schedule_work(&entry->delete_netdev); - } + INIT_WORK(&entry->delete_netdev, delete_netdev); + schedule_work(&entry->delete_netdev); } else { spin_unlock(&devices_lock); } -- 2.53.0