From abb4b34156cf82438615562394c9e409914e07f1 Mon Sep 17 00:00:00 2001 From: Zhengping Jiang Date: Tue, 28 Oct 2025 15:00:49 +0800 Subject: [PATCH] Bluetooth: L2CAP: Fix use-after-free stable inclusion from stable-v4.19.293 commit 1a40c56e8bff3e424724d78a9a6b3272dd8a371d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBVV CVE: CVE-2023-53305 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1a40c56e8bff3e424724d78a9a6b3272dd8a371d -------------------------------- [ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ] Fix potential use-after-free in l2cap_le_command_rej. Signed-off-by: Zhengping Jiang Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Signed-off-by: Yuan Can --- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 22e971808536..cdb0a9f6f9fd 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5712,9 +5712,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn, if (!chan) goto done; + chan = l2cap_chan_hold_unless_zero(chan); + if (!chan) + goto done; + l2cap_chan_lock(chan); l2cap_chan_del(chan, ECONNREFUSED); l2cap_chan_unlock(chan); + l2cap_chan_put(chan); done: mutex_unlock(&conn->chan_lock); -- Gitee