Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in l2cap_chan_hold_unless_zero

[Hillf Danton <hdanton@sina.com>]

> Date: Mon, 20 Jul 2026 16:56:27 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    e22254e9ddd8 Merge tag 'xfs-fixes-7.2-rc4' of git://git.ke..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13d46789580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=48ef5c5c0f192153
> dashboard link: https://syzkaller.appspot.com/bug?extid=e6382a2f53f5fc7453ac
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17b434b9580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17d46789580000

#syz test

--- x/net/bluetooth/l2cap_sock.c
+++ y/net/bluetooth/l2cap_sock.c
@@ -1532,7 +1532,9 @@ static void l2cap_sock_cleanup_listen(st
 		struct l2cap_chan *chan;
 
 		lock_sock_nested(sk, L2CAP_NESTING_NORMAL);
-		chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
+		chan = l2cap_pi(sk)->chan;
+		if (chan)
+			chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan);
 		release_sock(sk);
 		if (!chan) {
 			/* l2cap_conn_del() already tearing this child down */
--