From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-240.mail.qq.com (out203-205-221-240.mail.qq.com [203.205.221.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 888CE26D4F6 for ; Tue, 25 Nov 2025 13:56:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.240 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764078965; cv=none; b=rjl4DYImRTRySaLKK63ueAYkvdz+enpqTocv66GEhiMsyN0Vy62uxW9QxbysUi1RKH7KKPfmyi4Epsd4r/fmnvsZ3xDAxyNAVXXiJd6JPNGyjiez4I2TR0UpjLlZopdW/66hCnwfFS+NaSOv+U0LGhansEn08soCZ9X9XtiT8y8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764078965; c=relaxed/simple; bh=4ttDPPTBNW+DIVPsmLIBBDDcgOQplxk2vF9URAcZJb0=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=LGhol9raWL/ihGuGnHHzKy40BVFsTPPCXwfK6PxzNRqjdSB1gdY2bTHyRx4AyjGJtnCrEe3xRQFAxk3c37GWKi94QY4hAc4IhkCQxHwiXCDJMABUnBCVZPWm+ItTvpquTjkAP3k849gftt3IdF4FhjSMAxC/hZW2jYVWU2YPL+A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=THCS5CMx; arc=none smtp.client-ip=203.205.221.240 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="THCS5CMx" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1764078949; bh=NY7zhizNVELeF1dsZbPjL2cMpCDqQHA8d7pBE1SSwko=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=THCS5CMxfBbhnE+R6E8Z1iD96oxZPEUByvDXofxHugsT5yL+ZUT988UfjOXpHXLBh cWRd65fWbyemIKQg9GfNfMs4fyteAokgqcIFUeW0eJ2EymNdfFltc6scO0DblwZ7Gr 8XepLKaq8Yms5YqAfJzEE5CN2pJKC5lPVhZNJKeM= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrszc50-0.qq.com (NewEsmtp) with SMTP id DF03546B; Tue, 25 Nov 2025 21:55:48 +0800 X-QQ-mid: xmsmtpt1764078948txxd0w8b5 Message-ID: X-QQ-XMAILINFO: MSavithc86ZZyzTkt50UT3DuufjleNXJ/w8vU3w+GG70CQCktX9zHGqo4EuI0l XoBDmCG8HzIzPaML9xLHlAXuZyonXTGRmPklcj/siwdlRT3yldgiq9S1aTVzbFKxgTzrKk1YsNBd 1pUiio696GgQgbbk9KzrOxIhFr371QkiPhxnCNs3QLeZSZqzgV7a3pu1VmAhKyaqGlOvq3bI+HN+ yuTbiHRjK5BiTIFl7MerOGhW1hYEIcLen7PPrpz6d6Cj2/hgZgylFMoBF6CtnJdCsVxVsM3QXGzm ttjfdOauuOAPrtqkMKefovoKNDO1a2O1Fy+qLhXV/IcIsgnVYw09q/fGEyg1lbJJr5FP+QWfwv9G xVfvYKC/q187OBIpVcrw4NLAXIfRNlLfHa8IT3zD0K7MlM1eV024ds6ceEq3k5WFywjlDK4E9sxC f2YxM1BEcV38aqg897deV6JdCV9LCEheuOZZAwXjxu5kQH9jwZE/Hrq8lnYCnknq1I1tf8WKdt4I 9+1nciWIkCwCHSirDTvfvDCyICdP1UFS0EhYigjdiX0lmGFJcLnqsDOGJFDYpWOyAb5qedrPp+nT BfxqyRCjXawb5HOg4ZuRyRjjeHxeeYlqerEEEekSqlOhxBF+GcjrVZDq9ARjR684mPY5dSa6cV5R jJzpzbK7vrfSEmNbbLt6q87CNbAvjc2kQaO72xRs17X0SFrL1I/JOnhlUM2gaktuQOzoOy22nafg n/cR166e8peLFt+TOKFGQl9bJ1ul4LW4jWJO2i1sS8oND2+IkfLmRuvPNTUtoEU0nGlm3lFIsMiZ HwSFVkq0WOLn/zFjFK6ftPV3OCaU1Q4aW4QMQ/gVGdsDMQpgX+DcIRYX1US3ed8q5hsY1yn2cCfs Cd3Ezurt1cDk1217nrjNV5iG7qX/II8BXKglAK5H3nVIpLEliQTH1m5UBNKsrudxGpRw8WbtT1c/ LiAOd9KKb6J7CVpxFXoMqC3XwB7p2i1epoGJl8dOmEKYXj/pXg/YztpTwonaqQjTLrVp6TXs/fjn GTuvUBctw8gjBPYDnR X-QQ-XMRINFO: OD9hHCdaPRBwq3WW+NvGbIU= From: Edward Adam Davis To: syzbot+cdae834448ec8c3602fe@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb Date: Tue, 25 Nov 2025 21:55:48 +0800 X-OQ-MSGID: <20251125135547.4150089-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6923d897.a70a0220.2ea503.0077.GAE@google.com> References: <6923d897.a70a0220.2ea503.0077.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 814fb8610ac4..6532f11e3e17 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1411,6 +1411,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how) return err; } +static DEFINE_MUTEX(ra_lock); + static int l2cap_sock_release(struct socket *sock) { struct sock *sk = sock->sk; @@ -1422,9 +1424,9 @@ static int l2cap_sock_release(struct socket *sock) if (!sk) return 0; - lock_sock_nested(sk, L2CAP_NESTING_PARENT); + mutex_lock(&ra_lock); l2cap_sock_cleanup_listen(sk); - release_sock(sk); + mutex_unlock(&ra_lock); bt_sock_unlink(&l2cap_sk_list, sk); @@ -1473,6 +1475,7 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan) { struct sock *sk, *parent = chan->data; + guard(mutex)(&ra_lock); lock_sock(parent); /* Check for backlog size */