Re: [PATCH 6.1.y] Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref
Sasha Levin <[email protected]>
| Newsgroups | org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Thu, Aug 06, 2026 at 12:52:14AM +0000, Todd Kjos wrote:
> [ Upstream commit b66774b48dd98f07254951f74ea6f513efe7ff8b ]
>
> l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
> the connection is torn down while the timer is running or pending,
> chan->conn can be freed, leading to a use-after-free when the timer
> worker attempts to lock conn->lock:
Looks good. And I can also queue up d38eaf611839 ("Bluetooth: 6lowpan: Fix
using chan->conn as indication to no remote netdev") after the backport, but
your S-O-B is missing on the backport so we'll need it first :)
--
Thanks,
Sasha