Re: [PATCH linux-stable 6.6] Bluetooth: hci_conn: avoid queue when deleting hci connection

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Aug 19, 2025 at 10:16:05PM +0800, xu.xin16@zte.com.cn wrote:
> From: Chen Junlin <chen.junlin@zte.com.cn>
> 
> Although the upstream commit 2b0f2fc9ed62 ("Bluetooth: hci_conn:
> Use disable_delayed_work_sync") has fixed the issue CVE-2024-56591, that
> patch depends on the implementaion of disable/enable_work() of workqueue
> [1], which are merged into 6.9/6.10 and so on. But for branch linux-6.6,
> there&apos;s no these feature of workqueue.

html marker in a changelog text?

> To solve CVE-2024-56591 without backport too many feature patches about
> workqueue, we can set a new flag HCI_CONN_DELETE when hci_conn_dell() is
> called, and the subsequent queuing of work will be ignored.

How was this tested?

> 
> [1] https://lore.kernel.org/all/20240216180559.208276-1-tj@kernel.org/
> 
> Signed-off-by: Chen Junlin <chen.junlin@zte.com.cn>
> Signed-off-by: xu xin <xu.xin16@zte.com.cn>

What commit id does this fix?  Why only 6.6 for it?


> ---
> include/net/bluetooth/hci_core.h | 8 +++++++-
> net/bluetooth/hci_conn.c         | 1 +
> 2 files changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> index 4f067599e6e9..9a3ec55079a1 100644
> --- a/include/net/bluetooth/hci_core.h
> +++ b/include/net/bluetooth/hci_core.h
> @@ -954,6 +954,7 @@ enum {
>  	HCI_CONN_BIG_SYNC_FAILED,
>  	HCI_CONN_PA_SYNC,
>  	HCI_CONN_PA_SYNC_FAILED,
> +	HCI_CONN_DELETE,
> };
> 
> static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
> @@ -1575,7 +1576,12 @@ static inline void hci_conn_drop(struct hci_conn *conn)
>  		}
> 
>  		cancel_delayed_work(&conn->disc_work);
> -		queue_delayed_work(conn->hdev->workqueue,
> +		/*
> +		 * When HCI_CONN_DELETE is set, the conn is goint to be freed.
> +		 * Don&apos;t queue the work to avoid noisy WARNing about refcnt < 0.

Again, html text in a comment?

How does that happen?

thanks,

greg k-h