* Re: [syzbot] KASAN: use-after-free Read in l2cap_conn_del [not found] <000000000000fa882f05e9973a36@google.com> @ 2022-10-23 8:29 ` Hillf Danton 2022-10-23 15:43 ` syzbot 0 siblings, 1 reply; 2+ messages in thread From: Hillf Danton @ 2022-10-23 8:29 UTC (permalink / raw) To: syzbot; +Cc: linux-kernel, linux-mm, syzkaller-bugs On 26 Sep 2022 09:43:42 -0700 > syzbot found the following issue on: > > HEAD commit: aaa11ce2ffc8 Add linux-next specific files for 20220923 > git tree: linux-next > console+strace: https://syzkaller.appspot.com/x/log.txt?x=14b32754880000 > kernel config: https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294 > dashboard link: https://syzkaller.appspot.com/bug?extid=03450dacbc626061c3a3 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12d389c4880000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14269e38880000 Put refcount in balance for channel in bid to fix uaf. #syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git aaa11ce2ffc8 --- a/net/bluetooth/a2mp.c +++ b/net/bluetooth/a2mp.c @@ -896,6 +896,8 @@ struct l2cap_chan *a2mp_channel_create(s BT_ERR("Could not create AMP manager"); return NULL; } + /* pair with put in l2cap_data_channel() */ + l2cap_chan_hold(mgr->a2mp_chan); BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan); -- ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [syzbot] KASAN: use-after-free Read in l2cap_conn_del 2022-10-23 8:29 ` [syzbot] KASAN: use-after-free Read in l2cap_conn_del Hillf Danton @ 2022-10-23 15:43 ` syzbot 0 siblings, 0 replies; 2+ messages in thread From: syzbot @ 2022-10-23 15:43 UTC (permalink / raw) To: hdanton, linux-kernel, linux-mm, syzkaller-bugs Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-and-tested-by: syzbot+03450dacbc626061c3a3@syzkaller.appspotmail.com Tested on: commit: aaa11ce2 Add linux-next specific files for 20220923 git tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git console output: https://syzkaller.appspot.com/x/log.txt?x=172b6de2880000 kernel config: https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294 dashboard link: https://syzkaller.appspot.com/bug?extid=03450dacbc626061c3a3 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 patch: https://syzkaller.appspot.com/x/patch.diff?x=1069544a880000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-10-23 15:43 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <000000000000fa882f05e9973a36@google.com>
2022-10-23 8:29 ` [syzbot] KASAN: use-after-free Read in l2cap_conn_del Hillf Danton
2022-10-23 15:43 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).