Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev

b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding
conn ref") don't reset the chan->conn to NULL anymore making the bt#
netdev not be remove once the last l2cap_chan_del is removed.

Instead of restoring the original behavior this remove the logic of
keeping the interface after the last channel is removed because it
never worked as intended and the l2cap_chan_del always detach its
l2cap_conn which results in always removing the channel anyway.

Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index cb1e329d66fd4e5161e274a6c3d32c37dbf6fb81..962e0e885105fdaad83ea8866314c7f9628c3f36 100644 (file)
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -797,20 +797,10 @@ static void chan_close_cb(struct l2cap_chan *chan)
        struct lowpan_btle_dev *dev = NULL;
        struct lowpan_peer *peer;
        int err = -ENOENT;
-       bool last = false, remove = true;
+       bool last = false;
 
        BT_DBG("chan %p conn %p", chan, chan->conn);
 
-       if (chan->conn && chan->conn->hcon) {
-               if (!is_bt_6lowpan(chan->conn->hcon))
-                       return;
-
-               /* If conn is set, then the netdev is also there and we should
-                * not remove it.
-                */
-               remove = false;
-       }
-
        spin_lock(&devices_lock);
 
        list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
@@ -837,10 +827,8 @@ static void chan_close_cb(struct l2cap_chan *chan)
 
                ifdown(dev->netdev);
 
-               if (remove) {
-                       INIT_WORK(&entry->delete_netdev, delete_netdev);
-                       schedule_work(&entry->delete_netdev);
-               }
+               INIT_WORK(&entry->delete_netdev, delete_netdev);
+               schedule_work(&entry->delete_netdev);
        } else {
                spin_unlock(&devices_lock);
        }