Messages in this thread Patch in this message |  | | From | Hillf Danton <> | | Subject | Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd | | Date | Wed, 15 Jan 2025 13:28:49 +0800 |
| |
On Mon, 06 Jan 2025 01:04:23 -0800 > syzbot has found a reproducer for the following issue on: > > HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
#syz test
--- x/net/bluetooth/l2cap_core.c +++ y/net/bluetooth/l2cap_core.c @@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s } } +static DEFINE_SPINLOCK(l2cap_conn_del_lock); + static void l2cap_conn_del(struct hci_conn *hcon, int err) { struct l2cap_conn *conn = hcon->l2cap_data; @@ -1797,7 +1799,9 @@ static void l2cap_conn_del(struct hci_co if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); + spin_lock(&l2cap_conn_del_lock); hcon->l2cap_data = NULL; + spin_unlock(&l2cap_conn_del_lock); conn->hchan = NULL; l2cap_conn_put(conn); } @@ -1819,6 +1823,8 @@ EXPORT_SYMBOL(l2cap_conn_get); void l2cap_conn_put(struct l2cap_conn *conn) { + if (!conn) + return; kref_put(&conn->ref, l2cap_conn_free); } EXPORT_SYMBOL(l2cap_conn_put); @@ -7477,6 +7483,13 @@ void l2cap_recv_acldata(struct hci_conn if (!conn) goto drop; + spin_lock(&l2cap_conn_del_lock); + conn = hcon->l2cap_data; + if (conn) + l2cap_conn_get(conn); + spin_unlock(&l2cap_conn_del_lock); + if (!conn) + goto drop; BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); switch (flags) { @@ -7503,6 +7516,7 @@ void l2cap_recv_acldata(struct hci_conn if (len == skb->len) { /* Complete frame received */ l2cap_recv_frame(conn, skb); + l2cap_conn_put(conn); return; } @@ -7566,6 +7580,7 @@ void l2cap_recv_acldata(struct hci_conn } drop: + l2cap_conn_put(conn); kfree_skb(skb); } --
|  |