Re: [PATCH 6.1.y] Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

On Thu, Aug 6, 2026 at 10:49 AM Sasha Levin <[email protected]> wrote:
>
> On Thu, Aug 06, 2026 at 12:52:14AM +0000, Todd Kjos wrote:
> > [ Upstream commit b66774b48dd98f07254951f74ea6f513efe7ff8b ]
> >
> > l2cap_chan_timeout() runs asynchronously and accesses chan->conn. If
> > the connection is torn down while the timer is running or pending,
> > chan->conn can be freed, leading to a use-after-free when the timer
> > worker attempts to lock conn->lock:
>
> Looks good. And I can also queue up d38eaf611839 ("Bluetooth: 6lowpan: Fix
> using chan->conn as indication to no remote netdev") after the backport, but
> your S-O-B is missing on the backport so we'll need it first :)

Oh, sorry about that. Here it is:

Signed-off-by: Todd Kjos <[email protected]>

Is that sufficient or do you want a full v2 with the SOF added?

>
> --
> Thanks,
> Sasha