Re: [PATCH 1/5] Bluetooth: L2CAP: ignore close requests for deleted channels

[Pauli Virtanen]

Hi,

ma, 2026-09-21 kello 23:38 +0800, Cen Zhang kirjoitti:
> l2cap_chan_del() keeps chan->conn alive until channel destruction and
> marks removal with FLAG_DEL, but does not necessarily change the state.
> A caller retaining a temporary reference can therefore enter
> l2cap_chan_close_unlocked() after deletion and follow a stale connected
> state, rearming the channel timer and sending another disconnection
> request for a channel no longer on the connection list.
> 
> Check FLAG_DEL after taking the channel and connection locks so that
> concurrent deletion is serialized with the decision to close. Return
> without further timer or signaling work when the channel is deleted.
> 
> Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427@xxxxxxxxx>
> ---
>  net/bluetooth/l2cap_core.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 49a998804908..65e957fdc7ae 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -939,8 +939,10 @@ void l2cap_chan_close_unlocked(struct l2cap_chan *chan, int reason)
>  
>  	have_conn = l2cap_chan_lock_conn(chan);
>  
> -	/* Context analysis: consider chan->conn->lock held also if conn NULL */
> -	context_unsafe(__l2cap_chan_close(chan, reason));
> +	if (!test_bit(FLAG_DEL, &chan->flags)) {
> +		/* Consider chan->conn->lock held also if conn NULL */
> +		context_unsafe(__l2cap_chan_close(chan, reason));

This probably would better be further down in __l2cap_chan_close()
together with the other state check.

> +	}
>  
>  	l2cap_chan_unlock_conn(chan, have_conn);
>  }
> 
> base-commit: 019debf20bfd648b40ba10377ee0168db5eb241e

-- 
Pauli Virtanen