* [PATCH v1] Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
@ 2026-05-11 16:24 Luiz Augusto von Dentz
2026-05-11 17:10 ` [v1] " bluez.test.bot
0 siblings, 1 reply; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2026-05-11 16:24 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and in
fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected using
l2cap_send_disconn_req otherwise the remote peer would have no idea that
it shall consider to be disconnected.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/l2cap_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fdccd62ccca8..71846849e5b0 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5293,7 +5293,11 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
l2cap_chan_unlock(chan);
chan = __l2cap_get_chan_by_dcid(conn, dcid);
l2cap_chan_lock(chan);
- l2cap_chan_del(chan, ECONNRESET);
+ /* Disconnect the original channel as it may be
+ * considered connected since dcid has already been
+ * assigned.
+ */
+ l2cap_send_disconn_req(chan, ECONNRESET);
l2cap_chan_unlock(chan);
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH v1] Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp
@ 2026-05-11 16:23 Luiz Augusto von Dentz
2026-05-11 17:10 ` [v1] " bluez.test.bot
0 siblings, 1 reply; 3+ messages in thread
From: Luiz Augusto von Dentz @ 2026-05-11 16:23 UTC (permalink / raw)
To: linux-bluetooth
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
If dcid is received for an already-assigned destination CID the spec
requires that both channels to be discarded, but calling l2cap_chan_del
may invalidate the tmp cursor created by list_for_each_entry_safe and in
fact it is the wrong procedure as the chan->dcid may be assigned
previously it really needs to be disconnected using
l2cap_send_disconn_req otherwise the remote peer would have no idea that
it shall consider to be disconnected.
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---
net/bluetooth/l2cap_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fdccd62ccca8..71846849e5b0 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5293,7 +5293,11 @@ static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
l2cap_chan_unlock(chan);
chan = __l2cap_get_chan_by_dcid(conn, dcid);
l2cap_chan_lock(chan);
- l2cap_chan_del(chan, ECONNRESET);
+ /* Disconnect the original channel as it may be
+ * considered connected since dcid has already been
+ * assigned.
+ */
+ l2cap_send_disconn_req(chan, ECONNRESET);
l2cap_chan_unlock(chan);
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-11 17:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-11 16:24 [PATCH v1] Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp Luiz Augusto von Dentz
2026-05-11 17:10 ` [v1] " bluez.test.bot
-- strict thread matches above, loose matches on Subject: below --
2026-05-11 16:23 [PATCH v1] " Luiz Augusto von Dentz
2026-05-11 17:10 ` [v1] " bluez.test.bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox