Re: [PATCH] Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN
| Newsgroups | org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178647901488.1134064.17530228641432806685.git-patchwork-notify@kernel.org> |
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <[email protected]>: On Sun, 9 Aug 2026 01:06:05 +0300 you wrote: > New sk should not be added to parent socket accept queue after last > l2cap_sock_cleanup_listen() has run in l2cap_sock_teardown_cb() and > state set to BT_CLOSED, as that can result to UAF on dereferencing the > dangling parent reference. > > l2cap_sock_new_connection_cb() may race with parent l2cap_chan teardown, > due to chan->state accessed without consistent locking: > > [...] Here is the summary with links: - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN https://git.kernel.org/bluetooth/bluetooth-next/c/9db7e5fffbae You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html