Re: [PATCH v2 1/2 5.10.y, 5.15.y] Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Hey Todd,

I think you tackled only one of the conditionals. The "reinstated NULL check on
conn" in the changelog landed in l2cap_chan_timeout(); l2cap_chan_del() is
identical to v1 and still starts the block with an unguarded deref:

> +	if (!test_and_set_bit(FLAG_DEL, &chan->flags)) {
> +		struct amp_mgr *mgr = chan->conn->hcon->amp_mgr;

5.15 and 5.10 both still ship net/bluetooth/a2mp.c, and a2mp_chan_open() calls
l2cap_chan_del(chan, 0) on the l2cap_ertm_init() failure path before the
channel is added, so chan->conn is NULL there. Pre-patch the if (conn) guard
made that a no-op; as written the backport turns it into a NULL deref. It
needs:

	if (chan->conn && !test_and_set_bit(FLAG_DEL, &chan->flags)) {

-- 
Thanks,
Sasha