linux-kernel - Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_new_connection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_9C4CA9A7E806CD12C3867FC9AFEEC86EDE06@qq.com>
Date: Tue, 25 Nov 2025 21:55:48 +0800
From: Edward Adam Davis <eadavis@...com>
To: syzbot+cdae834448ec8c3602fe@...kaller.appspotmail.com
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_sock_new_connection_cb

#syz test

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 814fb8610ac4..6532f11e3e17 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -1411,6 +1411,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
 	return err;
 }
 
+static DEFINE_MUTEX(ra_lock);
+
 static int l2cap_sock_release(struct socket *sock)
 {
 	struct sock *sk = sock->sk;
@@ -1422,9 +1424,9 @@ static int l2cap_sock_release(struct socket *sock)
 	if (!sk)
 		return 0;
 
-	lock_sock_nested(sk, L2CAP_NESTING_PARENT);
+	mutex_lock(&ra_lock);
 	l2cap_sock_cleanup_listen(sk);
-	release_sock(sk);
+	mutex_unlock(&ra_lock);
 
 	bt_sock_unlink(&l2cap_sk_list, sk);
 
@@ -1473,6 +1475,7 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
 {
 	struct sock *sk, *parent = chan->data;
 
+	guard(mutex)(&ra_lock);
 	lock_sock(parent);
 
 	/* Check for backlog size */