FAILED: patch "[PATCH] Bluetooth: serialize accept_q access" failed to apply to 6.1-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x e83f5e24da741fa9405aeeff00b08c5ee7c37b88
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026052841-railing-periscope-eaaf@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From e83f5e24da741fa9405aeeff00b08c5ee7c37b88 Mon Sep 17 00:00:00 2001
From: Jiexun Wang <[email protected]>
Date: Wed, 6 May 2026 19:43:30 +0800
Subject: [PATCH] Bluetooth: serialize accept_q access
bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import.
Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket.
include/net/bluetooth/bluetooth.h +1 -0
@@ -398,6 +398,7 @@ void baswap(bdaddr_t *dst, const bdaddr_t *src);struct bt_sock {struct sock sk;struct list_head accept_q; +spinlock_t accept_q_lock;/* protects accept_q */ struct sock *parent;unsigned long flags;void (*skb_msg_name)(struct sk_buff *,void *,int *);
net/bluetooth/af_bluetooth.c +66 -23
164 lines not on this page · raw message
Sasha Levin
maintainerPATCH 1/2 Bluetooth: Init sk_peer_* on bt_sock_alloc
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 464c702fb9374ff8f3f816f24fb7ac719dd20e1e ]
This makes sure peer information is always available via sock when using bt_sock_alloc.
Stable-dep-of: e83f5e24da74 ("Bluetooth: serialize accept_q access")
--- net/bluetooth/af_bluetooth.c | 24 ++++++++++++++++++++++++ net/bluetooth/hidp/sock.c | 10 +--------- net/bluetooth/l2cap_sock.c | 19 ------------------- 3 files changed, 25 insertions(+), 28 deletions(-)
net/bluetooth/af_bluetooth.c +24 -0
@@ -157,6 +157,14 @@ struct sock *bt_sock_alloc(struct net *net, struct socket *sock, sk->sk_protocol = proto; sk->sk_state =BT_OPEN ; +/* Init peer information so it can be properly monitored */ +if (!kern) { +spin_lock (&sk->sk_peer_lock); + sk->sk_peer_pid =get_pid (task_tgid (current)); + sk->sk_peer_cred =get_current_cred (); +spin_unlock (&sk->sk_peer_lock); + } +return sk; }EXPORT_SYMBOL (bt_sock_alloc);
@@ -201,6 +209,9 @@ EXPORT_SYMBOL(bt_sock_linked);void bt_accept_enqueue (struct sock *parent,struct sock *sk,bool bh) { +const struct cred *old_cred; +struct pid *old_pid; +BT_DBG ("parent %p, sk %p" , parent, sk);sock_hold (sk);
@@ -213,6 +224,19 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)list_add_tail (&bt_sk (sk)->accept_q, &bt_sk (parent)->accept_q);bt_sk (sk)->parent = parent; +/* Copy credentials from parent since for incoming connections the +* socket is allocated by the kernel. +*/ +spin_lock (&sk->sk_peer_lock); + old_pid = sk->sk_peer_pid; + old_cred = sk->sk_peer_cred; + sk->sk_peer_pid =get_pid (parent->sk_peer_pid); + sk->sk_peer_cred =get_cred (parent->sk_peer_cred); +spin_unlock (&sk->sk_peer_lock); + +put_pid (old_pid); +put_cred (old_cred); +if (bh)bh_unlock_sock (sk);else
net/bluetooth/hidp/sock.c +1 -9
@@ -256,21 +256,13 @@ static int hidp_sock_create(struct net *net, struct socket *sock, int protocol,if (sock->type !=SOCK_RAW )return -ESOCKTNOSUPPORT ; - sk =sk_alloc (net,PF_BLUETOOTH ,GFP_ATOMIC , &hidp_proto, kern); + sk =bt_sock_alloc (net, sock, &hidp_proto, protocol,GFP_ATOMIC , kern);if (!sk)return -ENOMEM ; -sock_init_data (sock, sk); - sock->ops = &hidp_sock_ops; - sock->state =SS_UNCONNECTED ; -sock_reset_flag (sk,SOCK_ZAPPED ); - - sk->sk_protocol = protocol; - sk->sk_state =BT_OPEN ; -bt_sock_link (&hidp_sk_list, sk);return 0 ;
net/bluetooth/l2cap_sock.c +0 -19
@@ -178,21 +178,6 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)return err; } -static void l2cap_sock_init_pid (struct sock *sk) -{ -struct l2cap_chan *chan =l2cap_pi (sk)->chan; - -/* Only L2CAP_MODE_EXT_FLOWCTL ever need to access the PID in order to -* group the channels being requested. -*/ -if (chan->mode !=L2CAP_MODE_EXT_FLOWCTL ) -return ; - -spin_lock (&sk->sk_peer_lock); - sk->sk_peer_pid =get_pid (task_tgid (current)); -spin_unlock (&sk->sk_peer_lock); -} -static int l2cap_sock_connect (struct socket *sock,struct sockaddr *addr,int alen,int flags) {
@@ -268,8 +253,6 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, chan->mode != L2CAP_MODE_EXT_FLOWCTL) chan->mode =L2CAP_MODE_LE_FLOWCTL ; -l2cap_sock_init_pid (sk); - err =l2cap_chan_connect (chan, la.l2_psm,__le16_to_cpu (la.l2_cid), &la.l2_bdaddr, la.l2_bdaddr_type);if (err)
@@ -325,8 +308,6 @@ static int l2cap_sock_listen(struct socket *sock, int backlog) goto done; } -l2cap_sock_init_pid (sk); - sk->sk_max_ack_backlog = backlog; sk->sk_ack_backlog =0 ;
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/2 Bluetooth: serialize accept_q access
From: Jiexun Wang <[email protected]>
[ Upstream commit e83f5e24da741fa9405aeeff00b08c5ee7c37b88 ]
bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import.
Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket.
--- include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 87 +++++++++++++++++++++++-------- 2 files changed, 66 insertions(+), 22 deletions(-)
include/net/bluetooth/bluetooth.h +1 -0
@@ -361,6 +361,7 @@ void baswap(bdaddr_t *dst, const bdaddr_t *src);struct bt_sock {struct sock sk;struct list_head accept_q; +spinlock_t accept_q_lock;/* protects accept_q */ struct sock *parent;unsigned long flags;void (*skb_msg_name)(struct sk_buff *,void *,int *);
net/bluetooth/af_bluetooth.c +65 -22
163 lines not on this page · raw message
Signature · 1 line
2.53.0