[STABLE v6.1-v5.10 0/2] Bluetooth: L2CAP: Follow-up fixes for b66774b48dd9 (v6.1-v5.10)

[Lee Jones <lee@kernel.org>]

Backport the two follow-up Fixes: commits for b66774b48dd9 ("Bluetooth:
L2CAP: Fix UAF in channel timeout by holding conn ref") that did not
apply cleanly to v6.1.y, v5.15.y, and v5.10.y.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: "Gustavo F. Padovan" <gustavo@padovan.org>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Marco Elver <elver@google.com>
Cc: Maxim Krasnyansky <maxk@qualcomm.com>
Cc: netdev@vger.kernel.org
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Pauli Virtanen <pav@iki.fi>
Cc: Sasha Levin <sashal@kernel.org>

Pauli Virtanen (2):
  Bluetooth: L2CAP: access chan->conn safely in get/setsockopt
  Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

 net/bluetooth/l2cap_core.c |  7 ++++-
 net/bluetooth/l2cap_sock.c | 59 +++++++++++++++++++++++++++++++-------
 2 files changed, 54 insertions(+), 12 deletions(-)

-- 
2.56.0.307.g5fe7bd680c-goog