On Tue, Aug 19, 2025 at 10:16:05PM +0800, xu.xin16@xxxxxxxxxx wrote:
> From: Chen Junlin <chen.junlin@xxxxxxxxxx>
>
> Although the upstream commit 2b0f2fc9ed62 ("Bluetooth: hci_conn:
> Use disable_delayed_work_sync") has fixed the issue CVE-2024-56591, that
> patch depends on the implementaion of disable/enable_work() of workqueue
> [1], which are merged into 6.9/6.10 and so on. But for branch linux-6.6,
> there's no these feature of workqueue.
html marker in a changelog text?
> To solve CVE-2024-56591 without backport too many feature patches about
> workqueue, we can set a new flag HCI_CONN_DELETE when hci_conn_dell() is
> called, and the subsequent queuing of work will be ignored.
How was this tested?
>
> [1] https://lore.kernel.org/all/20240216180559.208276-1-tj@xxxxxxxxxx/
>
> Signed-off-by: Chen Junlin <chen.junlin@xxxxxxxxxx>
> Signed-off-by: xu xin <xu.xin16@xxxxxxxxxx>
What commit id does this fix? Why only 6.6 for it?
> ---
> include/net/bluetooth/hci_core.h | 8 +++++++-
> net/bluetooth/hci_conn.c | 1 +
> 2 files changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
> index 4f067599e6e9..9a3ec55079a1 100644
> --- a/include/net/bluetooth/hci_core.h
> +++ b/include/net/bluetooth/hci_core.h
> @@ -954,6 +954,7 @@ enum {
> HCI_CONN_BIG_SYNC_FAILED,
> HCI_CONN_PA_SYNC,
> HCI_CONN_PA_SYNC_FAILED,
> + HCI_CONN_DELETE,
> };
>
> static inline bool hci_conn_ssp_enabled(struct hci_conn *conn)
> @@ -1575,7 +1576,12 @@ static inline void hci_conn_drop(struct hci_conn *conn)
> }
>
> cancel_delayed_work(&conn->disc_work);
> - queue_delayed_work(conn->hdev->workqueue,
> + /*
> + * When HCI_CONN_DELETE is set, the conn is goint to be freed.
> + * Don't queue the work to avoid noisy WARNing about refcnt < 0.
Again, html text in a comment?
How does that happen?
thanks,
greg k-h
