)]}'
{
  "commit": "8c8e620467a7b51562dbcefbd1f09f288d7d710d",
  "tree": "947a53eadbec7a1cc42ce1498e01b7fc9e373e64",
  "parents": [
    "9dbd84990394c51f5cee1e8871bb5ff8af5ed939"
  ],
  "author": {
    "name": "Siwei Zhang",
    "email": "oss@fourdim.xyz",
    "time": "Wed May 20 22:12:20 2026 -0400"
  },
  "committer": {
    "name": "Luiz Augusto von Dentz",
    "email": "luiz.von.dentz@intel.com",
    "time": "Wed May 27 16:44:01 2026 -0400"
  },
  "message": "Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()\n\nl2cap_chan_close() removes the channel from conn-\u003echan_l, which\nmust be done under conn-\u003elock.  cleanup_listen() runs under the\nparent sk_lock, so acquiring conn-\u003elock would invert the\nestablished conn-\u003elock -\u003e chan-\u003elock -\u003e sk_lock order.\n\nInstead of calling l2cap_chan_close() directly, schedule\nl2cap_chan_timeout with delay 0 to close the channel\nasynchronously.  The timeout handler already acquires conn-\u003elock\nand chan-\u003elock in the correct order.\n\nThe timer is only armed when chan-\u003econn is still set: if it is\nalready NULL, l2cap_conn_del() has already processed this channel\n(l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb),\nso there is nothing left to do.  If l2cap_conn_del() races in\nafter the timer is armed, __clear_chan_timer() inside\nl2cap_chan_del() cancels it; if the timer has already fired, the\nhandler returns harmlessly because chan-\u003econn was cleared.\n\nFixes: 3df91ea20e74 (\"Bluetooth: Revert to mutexes from RCU list\")\nCc: \u003cstable@vger.kernel.org\u003e # 0b58004: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()\nSigned-off-by: Siwei Zhang \u003coss@fourdim.xyz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b34e7da8d90672150859ea2035f47fd26d98a329",
      "old_mode": 33188,
      "old_path": "net/bluetooth/l2cap_sock.c",
      "new_id": "c138aa4ae26690277b812a376835872aea7e3ddf",
      "new_mode": 33188,
      "new_path": "net/bluetooth/l2cap_sock.c"
    }
  ]
}