Re: [PATCH 1/2] Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
From: patchwork-bot+bluetooth
Date: Tue Aug 04 2026 - 13:50:14 EST
Hello:
This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:
On Sat, 1 Aug 2026 21:37:23 +0300 you wrote:
> hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via
> hci_conn_timeout (disc_work) -> hci_proto_disconn_ind ->
> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted
> concurrently.
>
> disc_work is disabled sync in hci_conn_del(), so we cannot take
> hci_dev_lock in disc_work.
>
> [...]
Here is the summary with links:
- [1/2] Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
https://git.kernel.org/bluetooth/bluetooth-next/c/b974e13aafe9
- [2/2] Bluetooth: add annotations for l2cap_data locking context
https://git.kernel.org/bluetooth/bluetooth-next/c/d740cf77461a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html