Re: [PATCH v2] Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

[Marco Elver]

On Fri, 5 Jun 2026 at 17:48, Luiz Augusto von Dentz
<luiz.dentz@xxxxxxxxx> wrote:
[..]
> While I consider this a much cleaner approach than any the previous,
> perhaps we could go one step further and stop using chan->conn as an
> indiciation that l2cap_chan_del has run/detach l2cap_chan and instead
> perhaps use a flag e.g. FLAG_DEL, that way we can make chan->conn be
> used for reference tracking alone and don't need to introduce yet
> another field for it.

I agree in theory, but this is a larger refactor and needs a careful
audit of every user of conn in conditionals. Haven't had time to look
at that yet.

Thanks,
-- Marco