--- /dev/null
+From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Date: Fri, 12 Jun 2026 10:21:09 -0400
+Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev
+
+From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+
+commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream.
+
+b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding
+conn ref") don't reset the chan->conn to NULL anymore making the bt#
+netdev not be remove once the last l2cap_chan_del is removed.
+
+Instead of restoring the original behavior this remove the logic of
+keeping the interface after the last channel is removed because it
+never worked as intended and the l2cap_chan_del always detach its
+l2cap_conn which results in always removing the channel anyway.
+
+Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref")
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/6lowpan.c | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+--- a/net/bluetooth/6lowpan.c
++++ b/net/bluetooth/6lowpan.c
+@@ -777,20 +777,10 @@ static void chan_close_cb(struct l2cap_c
+ struct lowpan_btle_dev *dev = NULL;
+ struct lowpan_peer *peer;
+ int err = -ENOENT;
+- bool last = false, remove = true;
++ bool last = false;
+
+ BT_DBG("chan %p conn %p", chan, chan->conn);
+
+- if (chan->conn && chan->conn->hcon) {
+- if (!is_bt_6lowpan(chan->conn->hcon))
+- return;
+-
+- /* If conn is set, then the netdev is also there and we should
+- * not remove it.
+- */
+- remove = false;
+- }
+-
+ spin_lock(&devices_lock);
+
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+@@ -817,10 +807,8 @@ static void chan_close_cb(struct l2cap_c
+
+ ifdown(dev->netdev);
+
+- if (remove) {
+- INIT_WORK(&entry->delete_netdev, delete_netdev);
+- schedule_work(&entry->delete_netdev);
+- }
++ INIT_WORK(&entry->delete_netdev, delete_netdev);
++ schedule_work(&entry->delete_netdev);
+ } else {
+ spin_unlock(&devices_lock);
+ }
--- /dev/null
+From 8fa30821180a9a19e78e9f4df1c0ba710252801e Mon Sep 17 00:00:00 2001
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Date: Tue, 16 Jun 2026 12:09:14 +0500
+Subject: timekeeping: Register default clocksource before taking tk_core.lock
+
+From: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+
+commit 8fa30821180a9a19e78e9f4df1c0ba710252801e upstream.
+
+Commit f24df84cbe05 ("time/jiffies: Register jiffies clocksource before
+usage") moved the jiffies clocksource registration into
+clocksource_default_clock(), so that it is registered lazily on the first
+call. __clocksource_register() acquires clocksource_mutex, but the first
+caller is timekeeping_init(), which invokes clocksource_default_clock()
+while holding tk_core.lock, a raw spinlock.
+
+Acquiring a sleeping mutex while holding a raw spinlock is invalid.
+
+The default clocksource only has to be registered before
+tk_setup_internals() consumes its mult/shift/maxadj. Neither
+clocksource_default_clock(), the ->enable() callback, nor the registration
+itself need tk_core.lock, so fetch and enable the clock before acquiring
+the lock. This preserves the "register before usage" ordering while
+keeping clocksource_mutex out of the raw spinlock section.
+
+clocksource_default_clock() has a second caller,
+clocksource_done_booting(), which invokes it with clocksource_mutex already
+held. That path avoids a recursive lock because timekeeping_init() has
+already run and set cs_jiffies_registered, so the registration is skipped
+there. This change does not alter that; it only fixes the invalid wait
+context in timekeeping_init().
+
+Fixes: f24df84cbe05 ("time/jiffies: Register jiffies clocksource before usage")
+Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Reported-by: Breno Leitao <leitao@debian.org>
+Reported-by: Oleg Nesterov <oleg@redhat.com>
+Reviewed-by: Breno Leitao <leitao@debian.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/time/timekeeping.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -1825,13 +1825,14 @@ void __init timekeeping_init(void)
+ */
+ wall_to_mono = timespec64_sub(boot_offset, wall_time);
+
++ clock = clocksource_default_clock();
++ if (clock->enable)
++ clock->enable(clock);
++
+ guard(raw_spinlock_irqsave)(&tk_core.lock);
+
+ ntp_init();
+
+- clock = clocksource_default_clock();
+- if (clock->enable)
+- clock->enable(clock);
+ tk_setup_internals(tks, clock);
+
+ tk_set_xtime(tks, &wall_time);
projects / thirdparty / kernel / stable-queue.git / commitdiff
