From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from xmbghk7.mail.qq.com (xmbghk7.mail.qq.com [43.163.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E267320CDB for ; Tue, 25 Nov 2025 13:08:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=43.163.128.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764076092; cv=none; b=j2t/ZMRhnW1mtZSj5E8dUZJRqY4V9pMcHl2+AgZO+EIYF+XYzQVOJ1CsbnbzXVzyo9wwZdxfN3BclJzJowQACeG/+NsPwplppo2wGOtLGPNE86eUOvEdwvq+wzwUE0p5Moje2mlBh2wHkVrWlQ5rPYy1cK9QRGu5ewVir+Fk3Ww= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764076092; c=relaxed/simple; bh=7paDwr9W0ptGXkTQDwEBxGsks4SU7SDah61w29faaiA=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=neOEORjgfJzzroq4v7bricnNoGiCkfRGrrQumpjHLJ2apdB1EZd8cXTkiP/hg7xlzL3oHJiOYcqxlndz1MlNYuUewSQD2K3/p35qO7fMeoiEUXMXNRYpOtBgIbQ9VnDKxTINUx1MDIdU6JkZq6KyNuOShoYDPxFo1+wDD1XZRx0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=LjX+fx7Y; arc=none smtp.client-ip=43.163.128.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="LjX+fx7Y" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1764076080; bh=1wqUOp+xbcmycwtWNd0GY2WV6pcz4l2bfvnLO6s/QF8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LjX+fx7YgoH9umSd+pdcJYNaoC0ncP2XjcrpuaqVenelGdyPR4Imp403IeTXgPx5a c2fif4WLYPmddycqMe/LnHYcjSs26dCxKWqNmnWkUkvqU3sbiBWic31IGTRrO5Nro7 k4tJAB3AYxLVNQjzT8XvqMZndqb6tfj70pGICixU= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza56-0.qq.com (NewEsmtp) with SMTP id 1FA90843; Tue, 25 Nov 2025 21:07:58 +0800 X-QQ-mid: xmsmtpt1764076078ty7ikpp8w Message-ID: X-QQ-XMAILINFO: OOyEews/EdUghqmlLJk89FrEbDp/SvaQqLZIfCXeYV5b0TeHv6Uggm42r0pAc/ Fg080Ps10eHQoNb4/dvSX8RmK8eM6K4r1PG2Gov2gNB79mcxH521i+U5ltS54+n1F/ekBpAF6jH0 stbNU9LNaARE40TxyXspNNrKWNc0MIFQ7cAk83XMpsU+zkZq7cdYPcl63D4jkfuJHBcYygQnXkBf j6WFL602DrpmVnu1YUUG2XiuTUIxOgzPcCKis/wdqwxPAc4whbEq4H5xHA8eU+C9D+aVXvdhrkz8 eklkWYNBhTet5lQw46fntQfWt3eZoUOzXPuGv1YMm0OmKMYfpCb61FWNX9X2hVshf5H4wKJLKOXE v5qOD2fbW1leUamsUoWNyoPX8egQQvaoqL7gbS/pYzR/sdTCwonQDqOIYWrh+o5f77+17duhI2Z3 ZHNEIxUGDVgRp7S8RP47/fVouhrQ5nyqE0obSKJKMEEgmER7wlb0xecbaDvtvn37HPVhItF1qyIa 8dDS5XGg2Wn+5GD2kQNL8+cDvfFLTjO4fjnYOq6hA/J+PdBbJ9lkmeJ3rl1jCyzIdtBwbRVjSpw1 qwYTnllQAGRRFdwpyHaT8pzxmFc9rshXDi8p2mSZH+qim6GxQiVkX21/QX9RTMLJq6gXZhKR1MP5 MdpyevTQtE/R6bzC6bvBSydsNSfuiJh0DCRixIISxUKfLTilC5r3D/0ZU16pI5XGvWpRLgNyUA8t dS/bWUTrLWY+0VyIKK3ZjIMELSG0GsQLsIOdQuKRm0TX2biIRWBVkth+I6mPqzTxZkWFuN0JA/kV Rcg/8yEvPC8Gj0IpIi4OTYDiRIufqesikbSMaVfKdYowjYtnpGwZDKz6sbwseankg89V9pEoD0u7 VX3cDh1Io5HajIJPbNoveRyDqMwLDZbPie7Yq1JshdrrB2l2prU24pFUyriII/qcOh2CJNzHXCnR wGIBmihZYps4uiNrDW4n0VfTOXiIWoXoypEvJmkenjiMJwYKqOlfOMduFoSCjE X-QQ-XMRINFO: NI4Ajvh11aEj8Xl/2s1/T8w= From: Edward Adam Davis To: syzbot+cdae834448ec8c3602fe@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb Date: Tue, 25 Nov 2025 21:07:59 +0800 X-OQ-MSGID: <20251125130758.4147519-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6923d897.a70a0220.2ea503.0077.GAE@google.com> References: <6923d897.a70a0220.2ea503.0077.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 814fb8610ac4..20939ab32b13 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1411,6 +1411,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) return err; } +static DEFINE_MUTEX(ra_lock); + static int l2cap_sock_release(struct socket *sock) { struct sock *sk = sock->sk; @@ -1422,9 +1424,8 @@ static int l2cap_sock_release(struct socket *sock) if (!sk) return 0; - lock_sock_nested(sk, L2CAP_NESTING_PARENT); + guard(mutex)(&ra_lock); l2cap_sock_cleanup_listen(sk); - release_sock(sk); bt_sock_unlink(&l2cap_sk_list, sk); @@ -1473,6 +1474,7 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) { struct sock *sk, *parent = chan->data; + guard(mutex)(&ra_lock); lock_sock(parent); /* Check for backlog size */