Dudu Lu 0ccd75c51f Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp ...

[ Upstream commit 42776497cd ]

l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without holding
l2cap_chan_lock(). Every other l2cap_chan_del() caller in the file
acquires the lock first. A remote BLE device can send a crafted
L2CAP ECRED reconfiguration response to corrupt the channel list
while another thread is iterating it.

Add l2cap_chan_hold() and l2cap_chan_lock() before l2cap_chan_del(),
and l2cap_chan_unlock() and l2cap_chan_put() after, matching the
pattern used in l2cap_ecred_conn_rsp() and l2cap_conn_del().

Fixes: 15f02b9105 ("Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:39:08 +02:00

..

bnep

…

cmtp

…

hidp

Bluetooth: HIDP: Fix possible UAF

2026-03-25 11:03:20 +01:00

rfcomm

tty: introduce and use tty_port_tty_vhangup() helper

2026-01-11 15:19:23 +01:00

6lowpan.c

Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions

2025-12-07 06:12:32 +09:00

a2mp.c

…

a2mp.h

…

af_bluetooth.c

…

amp.c

…

amp.h

…

aosp.c

…

aosp.h

…

ecdh_helper.c

…

ecdh_helper.h

…

eir.c

Bluetooth: eir: Fix possible crashes on eir_create_adv_data

2026-04-11 14:16:38 +02:00

eir.h

Bluetooth: eir: Fix possible crashes on eir_create_adv_data

2026-04-11 14:16:38 +02:00

hci_codec.c

…

hci_codec.h

…

hci_conn.c

Bluetooth: hci_conn: use mod_delayed_work for active mode timeout

2026-03-04 07:20:28 -05:00

hci_core.c

Bluetooth: hci_core: Fix use-after-free in vhci_flush()

2026-03-25 11:03:23 +01:00

hci_debugfs.c

…

hci_debugfs.h

…

hci_event.c

Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER

2026-06-01 17:39:08 +02:00

hci_request.c

…

hci_request.h

Bluetooth: hci_sync: Remove remaining dependencies of hci_request

2026-06-01 17:38:54 +02:00

hci_sock.c

…

hci_sync.c

Bluetooth: hci_sync: Remove remaining dependencies of hci_request

2026-06-01 17:38:54 +02:00

hci_sysfs.c

Bluetooth: fix use-after-free in device_for_each_child()

2024-12-14 19:53:34 +01:00

iso.c

Bluetooth: ISO: Fix another instance of dst_type handling

2025-12-07 06:12:12 +09:00

Kconfig

…

l2cap_core.c

Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

2026-06-01 17:39:08 +02:00

l2cap_sock.c

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()

2026-06-01 17:39:03 +02:00

leds.c

…

leds.h

…

lib.c

…

Makefile

…

mgmt_config.c

…

mgmt_config.h

…

mgmt_util.c

Bluetooth: MGMT: iterate over mesh commands in mgmt_mesh_foreach()

2025-06-27 11:07:11 +01:00

mgmt_util.h

…

mgmt.c

Bluetooth: MGMT: validate mesh send advertising payload length

2026-04-11 14:16:23 +02:00

msft.c

…

msft.h

…

sco.c

Bluetooth: SCO: fix race conditions in sco_sock_connect()

2026-04-11 14:16:23 +02:00

selftest.c

…

selftest.h

…

smp.c

Bluetooth: SMP: force responder MITM requirements before building the pairing response

2026-04-11 14:16:26 +02:00

smp.h

Bluetooth: SMP: If an unallowed command is received consider it a failure

2025-07-24 08:51:52 +02:00