From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id B253C39E6F5
	for <stable@vger.kernel.org>; Fri, 15 May 2026 09:29:05 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1778837345; cv=none; b=PTspB32Ww31kza/szl+I7MMx+azCPtTCRhLhjZmJYx0ljJJn15kj07c0NUcBnma9XjSTSFgnnIDN0UNaTEnyOvTZRcHn2C3HVvXSf3BBoAsDlR2ROuX6zYxlBX5sb85vrGlFzPqNqXjouhsyfuVUfBGKE2aZesPJNws2UO69tCA=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1778837345; c=relaxed/simple;
	bh=oDn+fWZ992YKCmwO3OrdkyTSS35uifAJVtSnVo9X5AI=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=iwB6zLlS6o1np5wgEG31PWrgGFU026it35CxJGww5q4V+FFtZIDH+8nawCPy2zC+VWyDYUCiUNtslHFBvBZ3cUFwLlLVmEM73YAj9wbJUR1+KOmwA0hFoBLnjfT1rW5iQ/Ea4qPQ7f6o0U1Lz5nula0rSOWt6bJ32S9nEs3rKVM=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ez8tBPwD; arc=none smtp.client-ip=10.30.226.201
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ez8tBPwD"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC1C5C2BCB0;
	Fri, 15 May 2026 09:29:04 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org;
	s=korg; t=1778837345;
	bh=oDn+fWZ992YKCmwO3OrdkyTSS35uifAJVtSnVo9X5AI=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=ez8tBPwDhezzoOwGHRVdHCdgnNKXHl61rRaPm22YlaLYf2/QUI0VnTudReqQd3eKx
	 CjoL0pIJIYi9qSoXywzVMC9xN2QafKdxSrNIkfejTjlJ6YkUqswTSD+DHs2QmteNh4
	 1/aEPK38wpXhTzVDOenOAltzZcMtENkyyghE4weM=
Date: Fri, 15 May 2026 11:29:09 +0200
From: Greg KH <gregkh@linuxfoundation.org>
To: Siwei Zhang <oss@fourdim.xyz>
Cc: stable@vger.kernel.org,
	Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Subject: Re: [PATCH 6.12.y] Bluetooth: L2CAP: Fix null-ptr-deref in
 l2cap_sock_get_sndtimeo_cb()
Message-ID: <2026051556-union-footsore-3414@gregkh>
References: <2026051216-harsh-pretender-53e0@gregkh>
 <20260513130248.2192409-1-oss@fourdim.xyz>
Precedence: bulk
X-Mailing-List: stable@vger.kernel.org
List-Id: <stable.vger.kernel.org>
List-Subscribe: <mailto:stable+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:stable+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20260513130248.2192409-1-oss@fourdim.xyz>

On Wed, May 13, 2026 at 09:02:37AM -0400, Siwei Zhang wrote:
> Add the same NULL guard already present in
> l2cap_sock_resume_cb() and l2cap_sock_ready_cb().
> 
> Fixes: 8d836d71e222 ("Bluetooth: Access sk_sndtimeo indirectly in l2cap_core.c")
> Cc: stable@kernel.org
> Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> ---
>  net/bluetooth/l2cap_sock.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
> index 1960d35b3be0..adee617517bb 100644
> --- a/net/bluetooth/l2cap_sock.c
> +++ b/net/bluetooth/l2cap_sock.c
> @@ -1725,6 +1725,9 @@ static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
>  {
>  	struct sock *sk = chan->data;
>  
> +	if (!sk)
> +		return 0;
> +
>  	return sk->sk_sndtimeo;
>  }
>  
> -- 
> 2.54.0
> 
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>