From 72cd1357806387332903ce29ce03b846666342e6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 16 Jul 2026 15:19:57 +0200 Subject: [PATCH] 6.18-stable patches added patches: bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch --- ...nn-as-indication-to-no-remote-netdev.patch | 62 ++++++++++++++++++ queue-6.18/series | 2 + ...ocksource-before-taking-tk_core.lock.patch | 65 +++++++++++++++++++ 3 files changed, 129 insertions(+) create mode 100644 queue-6.18/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch create mode 100644 queue-6.18/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch diff --git a/queue-6.18/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch b/queue-6.18/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch new file mode 100644 index 0000000000..e63981338e --- /dev/null +++ b/queue-6.18/bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch @@ -0,0 +1,62 @@ +From d38eaf611839b85ade3dd3db309dbc8aaaaf0095 Mon Sep 17 00:00:00 2001 +From: Luiz Augusto von Dentz +Date: Fri, 12 Jun 2026 10:21:09 -0400 +Subject: Bluetooth: 6lowpan: Fix using chan->conn as indication to no remote netdev + +From: Luiz Augusto von Dentz + +commit d38eaf611839b85ade3dd3db309dbc8aaaaf0095 upstream. + +b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding +conn ref") don't reset the chan->conn to NULL anymore making the bt# +netdev not be remove once the last l2cap_chan_del is removed. + +Instead of restoring the original behavior this remove the logic of +keeping the interface after the last channel is removed because it +never worked as intended and the l2cap_chan_del always detach its +l2cap_conn which results in always removing the channel anyway. + +Fixes: b66774b48dd9 ("Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/6lowpan.c | 18 +++--------------- + 1 file changed, 3 insertions(+), 15 deletions(-) + +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -777,20 +777,10 @@ static void chan_close_cb(struct l2cap_c + struct lowpan_btle_dev *dev = NULL; + struct lowpan_peer *peer; + int err = -ENOENT; +- bool last = false, remove = true; ++ bool last = false; + + BT_DBG("chan %p conn %p", chan, chan->conn); + +- if (chan->conn && chan->conn->hcon) { +- if (!is_bt_6lowpan(chan->conn->hcon)) +- return; +- +- /* If conn is set, then the netdev is also there and we should +- * not remove it. +- */ +- remove = false; +- } +- + spin_lock(&devices_lock); + + list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) { +@@ -817,10 +807,8 @@ static void chan_close_cb(struct l2cap_c + + ifdown(dev->netdev); + +- if (remove) { +- INIT_WORK(&entry->delete_netdev, delete_netdev); +- schedule_work(&entry->delete_netdev); +- } ++ INIT_WORK(&entry->delete_netdev, delete_netdev); ++ schedule_work(&entry->delete_netdev); + } else { + spin_unlock(&devices_lock); + } diff --git a/queue-6.18/series b/queue-6.18/series index 71721bbe35..ddb9905c4c 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -475,3 +475,5 @@ fuse-uring-make-a-fuse_req-on-sqe-commit-only-findable-after-memcpy.patch fuse-uring-remove-request-less-entries-from-ent_w_req_queue-to-fix-null-deref.patch sched-fair-only-update-stats-for-allowed-cpus-when-looking-for-dst-group.patch usb-gadget-f_fs-initialize-epfile-in-early-to-fix-endpoint-direction-checks.patch +timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch +bluetooth-6lowpan-fix-using-chan-conn-as-indication-to-no-remote-netdev.patch diff --git a/queue-6.18/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch b/queue-6.18/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch new file mode 100644 index 0000000000..07eb415be8 --- /dev/null +++ b/queue-6.18/timekeeping-register-default-clocksource-before-taking-tk_core.lock.patch @@ -0,0 +1,65 @@ +From 8fa30821180a9a19e78e9f4df1c0ba710252801e Mon Sep 17 00:00:00 2001 +From: Mikhail Gavrilov +Date: Tue, 16 Jun 2026 12:09:14 +0500 +Subject: timekeeping: Register default clocksource before taking tk_core.lock + +From: Mikhail Gavrilov + +commit 8fa30821180a9a19e78e9f4df1c0ba710252801e upstream. + +Commit f24df84cbe05 ("time/jiffies: Register jiffies clocksource before +usage") moved the jiffies clocksource registration into +clocksource_default_clock(), so that it is registered lazily on the first +call. __clocksource_register() acquires clocksource_mutex, but the first +caller is timekeeping_init(), which invokes clocksource_default_clock() +while holding tk_core.lock, a raw spinlock. + +Acquiring a sleeping mutex while holding a raw spinlock is invalid. + +The default clocksource only has to be registered before +tk_setup_internals() consumes its mult/shift/maxadj. Neither +clocksource_default_clock(), the ->enable() callback, nor the registration +itself need tk_core.lock, so fetch and enable the clock before acquiring +the lock. This preserves the "register before usage" ordering while +keeping clocksource_mutex out of the raw spinlock section. + +clocksource_default_clock() has a second caller, +clocksource_done_booting(), which invokes it with clocksource_mutex already +held. That path avoids a recursive lock because timekeeping_init() has +already run and set cs_jiffies_registered, so the registration is skipped +there. This change does not alter that; it only fixes the invalid wait +context in timekeeping_init(). + +Fixes: f24df84cbe05 ("time/jiffies: Register jiffies clocksource before usage") +Signed-off-by: Mikhail Gavrilov +Signed-off-by: Thomas Gleixner +Reported-by: Breno Leitao +Reported-by: Oleg Nesterov +Reviewed-by: Breno Leitao +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/timekeeping.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -1825,13 +1825,14 @@ void __init timekeeping_init(void) + */ + wall_to_mono = timespec64_sub(boot_offset, wall_time); + ++ clock = clocksource_default_clock(); ++ if (clock->enable) ++ clock->enable(clock); ++ + guard(raw_spinlock_irqsave)(&tk_core.lock); + + ntp_init(); + +- clock = clocksource_default_clock(); +- if (clock->enable) +- clock->enable(clock); + tk_setup_internals(tks, clock); + + tk_set_xtime(tks, &wall_time); -- 2.47.3