Messages in this thread Patch in this message |  | | From | Hillf Danton <> | | Subject | Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_send_cmd | | Date | Wed, 15 Jan 2025 18:25:42 +0800 |
| |
On Mon, 06 Jan 2025 01:04:23 -0800 > syzbot has found a reproducer for the following issue on: > > HEAD commit: ab75170520d4 Merge tag 'linux-watchdog-6.13-rc6' of git://.. > git tree: upstream > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17fa36f8580000
#syz test
--- x/net/bluetooth/l2cap_core.c +++ y/net/bluetooth/l2cap_core.c @@ -1747,6 +1747,8 @@ static void l2cap_unregister_all_users(s } } +static DEFINE_MUTEX(l2cap_conn_del_lock); + static void l2cap_conn_del(struct hci_conn *hcon, int err) { struct l2cap_conn *conn = hcon->l2cap_data; @@ -1797,8 +1799,10 @@ static void l2cap_conn_del(struct hci_co if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) cancel_delayed_work_sync(&conn->info_timer); + mutex_lock(&l2cap_conn_del_lock); hcon->l2cap_data = NULL; conn->hchan = NULL; + mutex_unlock(&l2cap_conn_del_lock); l2cap_conn_put(conn); } @@ -7470,6 +7474,7 @@ void l2cap_recv_acldata(struct hci_conn { struct l2cap_conn *conn = hcon->l2cap_data; int len; + int locked = 0; if (!conn) conn = l2cap_conn_add(hcon); @@ -7477,6 +7482,11 @@ void l2cap_recv_acldata(struct hci_conn if (!conn) goto drop; + mutex_lock(&l2cap_conn_del_lock); + locked = 1; + conn = hcon->l2cap_data; + if (!conn) + goto drop; BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); switch (flags) { @@ -7503,6 +7513,7 @@ void l2cap_recv_acldata(struct hci_conn if (len == skb->len) { /* Complete frame received */ l2cap_recv_frame(conn, skb); + mutex_unlock(&l2cap_conn_del_lock); return; } @@ -7566,6 +7577,8 @@ void l2cap_recv_acldata(struct hci_conn } drop: + if (locked) + mutex_unlock(&l2cap_conn_del_lock); kfree_skb(skb); } --
|  |