On Tue, Aug 19, 2025 at 10:16:05PM +0800, xu.xin16@zte.com.cn wrote:
From: Chen Junlin chen.junlin@zte.com.cn
Although the upstream commit 2b0f2fc9ed62 ("Bluetooth: hci_conn: Use disable_delayed_work_sync") has fixed the issue CVE-2024-56591, that patch depends on the implementaion of disable/enable_work() of workqueue [1], which are merged into 6.9/6.10 and so on. But for branch linux-6.6, there's no these feature of workqueue.
html marker in a changelog text?
To solve CVE-2024-56591 without backport too many feature patches about workqueue, we can set a new flag HCI_CONN_DELETE when hci_conn_dell() is called, and the subsequent queuing of work will be ignored.
How was this tested?
[1] https://lore.kernel.org/all/20240216180559.208276-1-tj@kernel.org/
Signed-off-by: Chen Junlin chen.junlin@zte.com.cn Signed-off-by: xu xin xu.xin16@zte.com.cn
What commit id does this fix? Why only 6.6 for it?
include/net/bluetooth/hci_core.h | 8 +++++++- net/bluetooth/hci_conn.c | 1 + 2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 4f067599e6e9..9a3ec55079a1 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -954,6 +954,7 @@ enum { HCI_CONN_BIG_SYNC_FAILED, HCI_CONN_PA_SYNC, HCI_CONN_PA_SYNC_FAILED,
- HCI_CONN_DELETE,
};
static inline bool hci_conn_ssp_enabled(struct hci_conn *conn) @@ -1575,7 +1576,12 @@ static inline void hci_conn_drop(struct hci_conn *conn) }
cancel_delayed_work(&conn->disc_work);
queue_delayed_work(conn->hdev->workqueue,
/** When HCI_CONN_DELETE is set, the conn is goint to be freed.* Don't queue the work to avoid noisy WARNing about refcnt < 0.
Again, html text in a comment?
How does that happen?
thanks,
greg k-h