Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb

[Edward Adam Davis <eadavis@qq.com>]

#syz test

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 814fb8610ac4..20939ab32b13 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1411,6 +1411,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
 	return err;
 }
 
+static DEFINE_MUTEX(ra_lock);
+
 static int l2cap_sock_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
@@ -1422,9 +1424,8 @@ static int l2cap_sock_release(struct socket *sock)
 	if (!sk)
 		return 0;
 
-	lock_sock_nested(sk, L2CAP_NESTING_PARENT);
+	guard(mutex)(&ra_lock);
 	l2cap_sock_cleanup_listen(sk);
-	release_sock(sk);
 
 	bt_sock_unlink(&l2cap_sk_list, sk);
 
@@ -1473,6 +1474,7 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
 {
 	struct sock *sk, *parent = chan->data;
 
+	guard(mutex)(&ra_lock);
 	lock_sock(parent);
 
 	/* Check for backlog size */