Re: [PATCH v2] Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Sat,  8 Aug 2026 12:08:45 +0300 you wrote:
> For L2CAP sockets without owning sk->sk_socket, reading
> l2cap_pi(sk)->chan may race against concurrent l2cap_sock_kill() ->
> l2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,
> but access in l2cap_sock_cleanup_listen() has unsafe lockless read.
> 
>  [Task 1]                         [Task 2 (hdev->workqueue)]
>  l2cap_sock_release(parent)       l2cap_disconn_cfm
>    l2cap_sock_cleanup_listen        l2cap_conn_del
>      bt_accept_dequeue                l2cap_chan_del
>        lock_sock(sk)                    l2cap_sock_teardown_cb
>        bt_accept_unlink
>          bt_sk(sk)->parent = NULL
>        release_sock(sk) ----------------> lock_sock(sk)
>                                           parent = /* NULL */
>      lock_sock(sk) <--------------------- release_sock(sk)
>                                           sock_set_flag(sk, SOCK_ZAPPED)
>                                       l2cap_sock_close_cb
>                                         l2cap_sock_kill(sk)
>                                           l2cap_sock_put_chan
>      chan = READ l2cap_pi(sk)->chan         l2cap_pi(sk)->chan = NULL
>      l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)
>        kref_get_unless_zero(&chan->ref)
> 
> [...]

Here is the summary with links:
  - [v2] Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan
    https://git.kernel.org/bluetooth/bluetooth-next/c/d67f4a43e7ef

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html