Re: [PATCH] Bluetooth: L2CAP: Keep recvmsg from resuming a closed channel

From: patchwork-bot+bluetooth

Date: Mon Nov 09 2026 - 18:00:37 EST


Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Mon, 9 Nov 2026 21:21:43 +0800 you wrote:
> Reading buffered ERTM data after ACL link loss can clear local busy and
> send a supervisory frame after l2cap_conn_del() has destroyed the HCI
> channel, which oopses on a NULL pointer in hci_send_acl(). The socket still
> owns its L2CAP channel, so its lifetime does not protect the underlying HCI
> channel.
>
> Require BT_CONNECTED before clearing local busy in recvmsg. The socket lock
> already held here serializes this check and send with teardown, which
> closes the socket before the HCI channel is destroyed. Continue to allow
> buffered data to be read after disconnection.
>
> [...]

Here is the summary with links:
- Bluetooth: L2CAP: Keep recvmsg from resuming a closed channel
https://git.kernel.org/bluetooth/bluetooth-next/c/1f2ac56137c5

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html