* [chrome-os:chromeos-6.1 18/18] net/bluetooth/l2cap_core.c:4101:2-8: preceding lock on line 4009
@ 2026-10-01 20:14 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-10-01 20:14 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Julia Lawall
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: cros-kernel-buildreports@googlegroups.com
tree: https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.1
head: e2d429338ffa976942aba4887d0b8a7e07dc0267
commit: 8629a65a48890769c47ebc9b6e57c02a80a8975e [18/18] Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
:::::: branch date: 7 hours ago
:::::: commit date: 10 weeks ago
config: x86_64-randconfig-r2107-20261001 (https://download.01.org/0day-ci/archive/20261001/202610012236.X9Oudppf-lkp@intel.com/config)
compiler: clang version 22.1.8 (https://github.com/llvm/llvm-project ca7933e47d3a3451d81e72ac174dcb5aa28b59d1)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Julia Lawall <julia.lawall@inria.fr>
| Closes: https://lore.kernel.org/r/202610012236.X9Oudppf-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> net/bluetooth/l2cap_core.c:4101:2-8: preceding lock on line 4009
vim +4101 net/bluetooth/l2cap_core.c
4e8402a3f88442 net/bluetooth/l2cap.c Marcel Holtmann 2007-10-20 3987
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 3988 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd,
4c89b6aad5b7c5 net/bluetooth/l2cap_core.c Mat Martineau 2012-10-11 3989 u8 *data, u8 rsp_code, u8 amp_id)
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 3990 {
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 3991 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 3992 struct l2cap_conn_rsp rsp;
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 3993 struct l2cap_chan *chan = NULL, *pchan = NULL;
e7c29cb16c8334 net/bluetooth/l2cap.c Marcel Holtmann 2008-09-09 3994 int result, status = L2CAP_CS_NO_INFO;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 3995
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 3996 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
8e036fc3143646 net/bluetooth/l2cap.c Al Viro 2007-07-29 3997 __le16 psm = req->psm;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 3998
097db76cdccd81 net/bluetooth/l2cap_core.c Andrei Emeltchenko 2012-03-09 3999 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4000
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4001 /* Check if we have socket listening on psm */
6f59b904ae57df net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-13 4002 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
bf20fd4ec1d39d net/bluetooth/l2cap_core.c Johan Hedberg 2013-05-14 4003 &conn->hcon->dst, ACL_LINK);
23691d75cdc69c net/bluetooth/l2cap_core.c Gustavo Padovan 2011-04-27 4004 if (!pchan) {
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4005 result = L2CAP_CR_BAD_PSM;
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 4006 goto response;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4007 }
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4008
3df91ea20e7443 net/bluetooth/l2cap_core.c Andrei Emeltchenko 2012-02-21 @4009 mutex_lock(&conn->chan_lock);
8ffb929098a569 net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-21 4010 l2cap_chan_lock(pchan);
e0f0cb56364958 net/bluetooth/l2cap.c Gustavo Padovan 2010-11-01 4011
e7c29cb16c8334 net/bluetooth/l2cap.c Marcel Holtmann 2008-09-09 4012 /* Check if the ACL is secure enough (if not SDP) */
dcf4adbfdc7ad1 net/bluetooth/l2cap_core.c Joe Perches 2014-03-12 4013 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
c6d527bbd3d389 net/bluetooth/l2cap_core.c Frédéric Danis 2025-04-09 4014 (!hci_conn_check_link_mode(conn->hcon) ||
15efa7d00fb304 net/bluetooth/l2cap_core.c Luiz Augusto von Dentz 2025-05-07 4015 !l2cap_check_enc_key_size(conn->hcon, pchan))) {
9f5a0d7bf079e9 net/bluetooth/l2cap_core.c Andrei Emeltchenko 2011-11-07 4016 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb16c8334 net/bluetooth/l2cap.c Marcel Holtmann 2008-09-09 4017 result = L2CAP_CR_SEC_BLOCK;
e7c29cb16c8334 net/bluetooth/l2cap.c Marcel Holtmann 2008-09-09 4018 goto response;
e7c29cb16c8334 net/bluetooth/l2cap.c Marcel Holtmann 2008-09-09 4019 }
e7c29cb16c8334 net/bluetooth/l2cap.c Marcel Holtmann 2008-09-09 4020
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4021 result = L2CAP_CR_NO_MEM;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4022
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4023 /* Check for valid dynamic CID range (as per Erratum 3253) */
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4024 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4025 result = L2CAP_CR_INVALID_SCID;
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4026 goto response;
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4027 }
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4028
2dfa1003ccd19b net/bluetooth/l2cap_core.c Gustavo Padovan 2012-05-27 4029 /* Check if we already have channel with that dcid */
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4030 if (__l2cap_get_chan_by_dcid(conn, scid)) {
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4031 result = L2CAP_CR_SCID_IN_USE;
2dfa1003ccd19b net/bluetooth/l2cap_core.c Gustavo Padovan 2012-05-27 4032 goto response;
dd1a8f8a88eecb net/bluetooth/l2cap_core.c Mallikarjun Phulari 2018-10-05 4033 }
2dfa1003ccd19b net/bluetooth/l2cap_core.c Gustavo Padovan 2012-05-27 4034
80b980279508ed net/bluetooth/l2cap_core.c Gustavo Padovan 2012-05-27 4035 chan = pchan->ops->new_connection(pchan);
80808e431e1ef2 net/bluetooth/l2cap_core.c Gustavo Padovan 2011-05-16 4036 if (!chan)
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4037 goto response;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4038
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4039 /* For certain devices (ex: HID mouse), support for authentication,
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4040 * pairing and bonding is optional. For such devices, inorder to avoid
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4041 * the ACL alive for too long after L2CAP disconnection, reset the ACL
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4042 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4043 */
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4044 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
330b6c1521d76d net/bluetooth/l2cap_core.c Syam Sidhardhan 2013-08-06 4045
7eafc59e2f547f net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-13 4046 bacpy(&chan->src, &conn->hcon->src);
7eafc59e2f547f net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-13 4047 bacpy(&chan->dst, &conn->hcon->dst);
a250e048a7fb32 net/bluetooth/l2cap_core.c Johan Hedberg 2015-01-15 4048 chan->src_type = bdaddr_src_type(conn->hcon);
a250e048a7fb32 net/bluetooth/l2cap_core.c Johan Hedberg 2015-01-15 4049 chan->dst_type = bdaddr_dst_type(conn->hcon);
fe4128e0aabc3c net/bluetooth/l2cap_core.c Gustavo Padovan 2011-04-13 4050 chan->psm = psm;
fe4128e0aabc3c net/bluetooth/l2cap_core.c Gustavo Padovan 2011-04-13 4051 chan->dcid = scid;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4052
6be3655552ee49 net/bluetooth/l2cap_core.c Andrei Emeltchenko 2012-02-22 4053 __l2cap_chan_add(conn, chan);
48454079c2d4b9 net/bluetooth/l2cap_core.c Gustavo Padovan 2011-03-25 4054
fe4128e0aabc3c net/bluetooth/l2cap_core.c Gustavo Padovan 2011-04-13 4055 dcid = chan->scid;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4056
8d836d71e2223b net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-15 4057 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4058
fc7f8a7ed45438 net/bluetooth/l2cap_core.c Gustavo Padovan 2011-03-25 4059 chan->ident = cmd->ident;
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4060
984947dc64f82b net/bluetooth/l2cap.c Marcel Holtmann 2009-02-06 4061 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
e7cafc45258c85 net/bluetooth/l2cap_core.c Johan Hedberg 2014-07-17 4062 if (l2cap_chan_check_security(chan, false)) {
bdc257830760a7 net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-14 4063 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
f93fa2732313ca net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-21 4064 l2cap_state_change(chan, BT_CONNECT2);
f66dc81f44d918 net/bluetooth/l2cap.c Marcel Holtmann 2009-01-15 4065 result = L2CAP_CR_PEND;
f66dc81f44d918 net/bluetooth/l2cap.c Marcel Holtmann 2009-01-15 4066 status = L2CAP_CS_AUTHOR_PEND;
2dc4e5105f012b net/bluetooth/l2cap_core.c Gustavo Padovan 2012-10-12 4067 chan->ops->defer(chan);
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4068 } else {
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4069 /* Force pending result for AMP controllers.
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4070 * The connection will succeed after the
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4071 * physical link is up.
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4072 */
6ed971ca4f6bd9 net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-05 4073 if (amp_id == AMP_ID_BREDR) {
f93fa2732313ca net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-21 4074 l2cap_state_change(chan, BT_CONFIG);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4075 result = L2CAP_CR_SUCCESS;
6ed971ca4f6bd9 net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-05 4076 } else {
f93fa2732313ca net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-21 4077 l2cap_state_change(chan, BT_CONNECT2);
6ed971ca4f6bd9 net/bluetooth/l2cap_core.c Marcel Holtmann 2013-10-05 4078 result = L2CAP_CR_PEND;
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4079 }
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4080 status = L2CAP_CS_NO_INFO;
f66dc81f44d918 net/bluetooth/l2cap.c Marcel Holtmann 2009-01-15 4081 }
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4082 } else {
f93fa2732313ca net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-21 4083 l2cap_state_change(chan, BT_CONNECT2);
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4084 result = L2CAP_CR_PEND;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4085 status = L2CAP_CS_AUTHEN_PEND;
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4086 }
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4087 } else {
f93fa2732313ca net/bluetooth/l2cap_core.c Gustavo Padovan 2013-10-21 4088 l2cap_state_change(chan, BT_CONNECT2);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4089 result = L2CAP_CR_PEND;
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4090 status = L2CAP_CS_NO_INFO;
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4091 }
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4092
^1da177e4c3f41 net/bluetooth/l2cap.c Linus Torvalds 2005-04-16 4093 response:
aca3192cc60d2b net/bluetooth/l2cap.c YOSHIFUJI Hideaki 2007-03-25 4094 rsp.scid = cpu_to_le16(scid);
aca3192cc60d2b net/bluetooth/l2cap.c YOSHIFUJI Hideaki 2007-03-25 4095 rsp.dcid = cpu_to_le16(dcid);
aca3192cc60d2b net/bluetooth/l2cap.c YOSHIFUJI Hideaki 2007-03-25 4096 rsp.result = cpu_to_le16(result);
aca3192cc60d2b net/bluetooth/l2cap.c YOSHIFUJI Hideaki 2007-03-25 4097 rsp.status = cpu_to_le16(status);
4c89b6aad5b7c5 net/bluetooth/l2cap_core.c Mat Martineau 2012-10-11 4098 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4099
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 4100 if (!pchan)
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 @4101 return;
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 4102
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4103 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4104 struct l2cap_info_req info;
dcf4adbfdc7ad1 net/bluetooth/l2cap_core.c Joe Perches 2014-03-12 4105 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4106
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4107 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4108 conn->info_ident = l2cap_get_ident(conn);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4109
ba13ccd9b911e0 net/bluetooth/l2cap_core.c Marcel Holtmann 2012-03-01 4110 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4111
2d7928184c3d87 net/bluetooth/l2cap_core.c Gustavo Padovan 2012-10-06 4112 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
2d7928184c3d87 net/bluetooth/l2cap_core.c Gustavo Padovan 2012-10-06 4113 sizeof(info), &info);
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4114 }
79d554a6976a29 net/bluetooth/l2cap.c Marcel Holtmann 2008-07-14 4115
c1360a1cf35117 net/bluetooth/l2cap_core.c Gustavo Padovan 2011-06-10 4116 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2ddd441f0 net/bluetooth/l2cap.c Gustavo Padovan 2010-07-08 4117 result == L2CAP_CR_SUCCESS) {
e9aeb2ddd441f0 net/bluetooth/l2cap.c Gustavo Padovan 2010-07-08 4118 u8 buf[128];
c1360a1cf35117 net/bluetooth/l2cap_core.c Gustavo Padovan 2011-06-10 4119 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2ddd441f0 net/bluetooth/l2cap.c Gustavo Padovan 2010-07-08 4120 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
e860d2c904d1a9 net/bluetooth/l2cap_core.c Ben Seri 2017-09-09 4121 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
73ffa904b78287 net/bluetooth/l2cap_core.c Gustavo Padovan 2011-03-25 4122 chan->num_conf_req++;
e9aeb2ddd441f0 net/bluetooth/l2cap.c Gustavo Padovan 2010-07-08 4123 }
1700915fef115b net/bluetooth/l2cap_core.c Mat Martineau 2012-10-23 4124
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 4125 l2cap_chan_unlock(pchan);
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 4126 mutex_unlock(&conn->chan_lock);
8629a65a488907 net/bluetooth/l2cap_core.c Sungwoo Kim 2026-07-15 4127 l2cap_chan_put(pchan);
4c89b6aad5b7c5 net/bluetooth/l2cap_core.c Mat Martineau 2012-10-11 4128 }
e9aeb2ddd441f0 net/bluetooth/l2cap.c Gustavo Padovan 2010-07-08 4129
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-10-01 20:14 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-01 20:14 [chrome-os:chromeos-6.1 18/18] net/bluetooth/l2cap_core.c:4101:2-8: preceding lock on line 4009 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.