From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-210.mail.qq.com (out203-205-221-210.mail.qq.com [203.205.221.210]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0164221F06 for ; Tue, 25 Nov 2025 12:14:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.210 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764072853; cv=none; b=I97smG8629vDkru5NQg/k1d9f2ER6DPT1Cnk03n2rb2721cym5agNJvLSUvJ1uX8nKR1DYEHLXUJUxzs1QnsSVIOqxDgYnLG6frionDZjFWpsa7VUAsVGgczMLp5JEnIE83r/1SsEzYKOCHAmdWpZN+eV299/yiY7DNHbi7gEPQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764072853; c=relaxed/simple; bh=IXE5Qn69vMOpqu489NNALyUnpij3mKMQSGcKbdlSQ24=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=adrrSb4JuuTH3I2SsW3DUbOMc1AYZ8FF33qBdUuT/p0j048ui/L/mWSk9IINvdPXNkFRQ6qtJzFb+IWodD2e+S6tuG2hxfm+UXp67B6fe9sNC+6sibbgaASChvvQZGSmM9+ugbWfYf3owSWJleWRxU+2K6KYKy+l4nrR/bVfq/I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=ok7BKRq/; arc=none smtp.client-ip=203.205.221.210 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="ok7BKRq/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1764072840; bh=5Q4vYauB/+xZoplVwHn2djOBVSeoK+9vKksssZfNR0Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ok7BKRq/7AqxPoIGdXdLkjdNLqKpw1qDcZe4XvhKd5Q4xrNRHwAypJI+Y4ijP0Lnp BNXIQ3gAkjwKwfuCZ19VvXe8ptsZmxmBD+FogzR2fT9xGZYn+i/kr6pOupAfGGNpFE 6tlPZHRNg6lXpK5XhKGoMCypw/6NQBkGPFFSTRoA= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrsza56-0.qq.com (NewEsmtp) with SMTP id 37A09C57; Tue, 25 Nov 2025 20:13:58 +0800 X-QQ-mid: xmsmtpt1764072838teg5osfmr Message-ID: X-QQ-XMAILINFO: MuMd8wcAiX0qcN+0edT8/EtO02xo62ESSaVyFlOlWxV8rRizJXiYxGo6EG7xVK zqELRpYozdhyMG8U04NQq3sVBJZKe7ZhGRu5ssmX7x+gkzTbCXTzD/28i3gST+nchSVCcw0Wz5kq uIQhOW6LfqRxS3fsXnxYZtyDix+/fu4eYghtNHHLMv2Akt8lArEHaN7WgSNGddfgKNwAY7VGZ4rx w3LxW1+YZd06VNmraciDu3tGH5Cd8sYwGFv20Cve99EOIaRNDhwxSlixOFBhpilDqH/3WlfYdXYc JwTSl2PGr5fnV1YHM+BujBpSD6MQZZKHlcMMidkhWQafPe+c5TUinMH2w1d6NDsnyKiZwxAX+3Z9 Uvw3WuJ8ryDY0CTjQYGWfBxZAr3k9qavTs9DucJCeWmNbSmNpOP2kUj5nNrqKOWRGCbwkm+eEG/u xK2aIjvAR1vCaMcbh+dVx5YwXOXox2PZtUgKECddUiO0kQsPV82YZBvPvGjoW3gMQS1lwZlNa55q S5R/X0e3YT7dNLvt+XcBt+cXExV3R0l5Mfd1Ck5qieUUWzegqyxc2QjPYpoBc273QFNHQEfxlC42 H/g+jQkw9dMCdICeRMCRI8GV+eJ9OYPwI19miaMs+VBRAVe0HN+u7dl5udCKAjeGvxR8lP/kmeeG bU7ne/oELANUOOzMkKfH7sOAPc18BTkMGLSiCkla2MsTUpIkckFvQT5VQ2iq8J/ddoo87NLsL0wk cU8kL/XtcUiudfFoZLn6SrToG/XpGd0sVp2RKjFhJYK7gLikb2V9wci+4XwI7fNFEy4Krw+j7LKs 81E6Rxx3XZ3kgb0FqFt4jToEYducfz/Q05E+gqF2iFlS6xXx01xzVpA9ghku2y1fAtloH7B4jos5 dS3a7mXes34h9Pxj6kpE/2tJv8jMk/bMhe/ZM6VbLZk6iBz/4W8RHP3qoIileEtJRhwd1CMD/SkN fnJDOWFbRrQwvDQF95QgAlGY2FJrYunaAeVZtMK4d2CHqofhS8wA== X-QQ-XMRINFO: Mp0Kj//9VHAxr69bL5MkOOs= From: Edward Adam Davis To: syzbot+cdae834448ec8c3602fe@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb Date: Tue, 25 Nov 2025 20:13:58 +0800 X-OQ-MSGID: <20251125121357.4143453-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6923d897.a70a0220.2ea503.0077.GAE@google.com> References: <6923d897.a70a0220.2ea503.0077.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 814fb8610ac4..6f2740d55dc0 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1422,7 +1422,7 @@ static int l2cap_sock_release(struct socket *sock) if (!sk) return 0; - lock_sock_nested(sk, L2CAP_NESTING_PARENT); + lock_sock(sk); l2cap_sock_cleanup_listen(sk); release_sock(sk);