[PATCH] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

[PATCH] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

[Hyunwoo Kim]

l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer
and id_addr_timer while holding conn->lock. However, the work functions
l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire
conn->lock, creating a potential AB-BA deadlock if the work is already
executing when l2cap_conn_del() takes the lock.

Move the cancel_delayed_work_sync() calls before acquiring conn->lock
to break the lock inversion.

Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/bluetooth/l2cap_core.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a6ce09781083..68bc65b1c12a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1752,6 +1752,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 
+	/* Cancel timers before acquiring conn->lock to prevent AB-BA
+	 * deadlock with l2cap_info_timeout() and
+	 * l2cap_conn_update_id_addr() which also acquire conn->lock.
+	 */
+	cancel_delayed_work_sync(&conn->info_timer);
+	cancel_delayed_work_sync(&conn->id_addr_timer);
+
 	mutex_lock(&conn->lock);
 
 	kfree_skb(conn->rx_skb);
@@ -1767,8 +1774,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 	ida_destroy(&conn->tx_ida);
 
-	cancel_delayed_work_sync(&conn->id_addr_timer);
-
 	l2cap_unregister_all_users(conn);
 
 	/* Force the connection to be immediately dropped */
@@ -1787,9 +1792,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 		l2cap_chan_put(chan);
 	}
 
-	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
-		cancel_delayed_work_sync(&conn->info_timer);
-
 	hci_chan_del(conn->hchan);
 	conn->hchan = NULL;
 
-- 
2.43.0

Re: [PATCH] Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()

[Luiz Augusto von Dentz]

Hi Hyunwoo,

On Thu, Mar 19, 2026 at 11:16 AM Hyunwoo Kim <imv4bel@gmail.com> wrote:
>
> l2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer
> and id_addr_timer while holding conn->lock. However, the work functions
> l2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire
> conn->lock, creating a potential AB-BA deadlock if the work is already
> executing when l2cap_conn_del() takes the lock.
>
> Move the cancel_delayed_work_sync() calls before acquiring conn->lock
> to break the lock inversion.
>
> Fixes: ab4eedb790ca ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
>  net/bluetooth/l2cap_core.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index a6ce09781083..68bc65b1c12a 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -1752,6 +1752,13 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
>
>         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
>
> +       /* Cancel timers before acquiring conn->lock to prevent AB-BA
> +        * deadlock with l2cap_info_timeout() and
> +        * l2cap_conn_update_id_addr() which also acquire conn->lock.
> +        */
> +       cancel_delayed_work_sync(&conn->info_timer);
> +       cancel_delayed_work_sync(&conn->id_addr_timer);
> +

While at it we might want to update this to use disable_delayed_work_sync

>         mutex_lock(&conn->lock);
>
>         kfree_skb(conn->rx_skb);
> @@ -1767,8 +1774,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
>
>         ida_destroy(&conn->tx_ida);
>
> -       cancel_delayed_work_sync(&conn->id_addr_timer);
> -
>         l2cap_unregister_all_users(conn);
>
>         /* Force the connection to be immediately dropped */
> @@ -1787,9 +1792,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
>                 l2cap_chan_put(chan);
>         }
>
> -       if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
> -               cancel_delayed_work_sync(&conn->info_timer);
> -
>         hci_chan_del(conn->hchan);
>         conn->hchan = NULL;
>
> --
> 2.43.0
>


-- 
Luiz Augusto von Dentz