Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp

l2cap_ecred_reconf_rsp() calls l2cap_chan_del() without first acquiring the channel lock or holding a reference on the channel. All other call sites of l2cap_chan_del() in l2cap_core.c (e.g., l2cap_disconnect_req, l2cap_ecred_conn_rsp) properly hold the channel lock and a reference.

Without the lock, concurrent operations on the same channel can lead to list corruption or use-after-free. Fix by adding l2cap_chan_hold + l2cap_chan_lock before the deletion and the corresponding unlock + put after, matching the established pattern.

---
 net/bluetooth/l2cap_core.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

index XXXXXXX..XXXXXXX 100644
@@ -5472,7 +5472,15 @@ static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
 		if (chan->ident != cmd->ident)
 			continue;
 
-		l2cap_chan_del(chan, ECONNRESET);
+		l2cap_chan_hold(chan);
+		l2cap_chan_lock(chan);
+
+		l2cap_chan_del(chan, ECONNRESET);
+
+		l2cap_chan_unlock(chan);
+		l2cap_chan_put(chan);
 	}
 
 	return 0;

This is an automated email and please do not reply to this email.

Dear Submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
While preparing the CI tests, the patches you submitted couldn't be applied to the current HEAD of the repository.

----- Output -----

error: corrupt patch at line 26
hint: Use 'git am --show-current-patch' to see the failed patch

Please resolve the issue and submit the patches again.

---
Regards,
Linux Bluetooth

Hi Dudu,

Didn't seem to be properly formatted for git am ingestion, did you use git format-patch?

Luiz Augusto von Dentz