Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in __lock_sock (2)

[Hillf Danton <hdanton@sina.com>]

On Sun, 16 Jun 2024 02:53:18 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    cea2a26553ac mailmap: Add my outdated addresses to the map..
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=115da30a980000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  cea2a26553ac

diff -pur c/include/net/bluetooth/l2cap.h d/include/net/bluetooth/l2cap.h
--- c/include/net/bluetooth/l2cap.h	2024-06-17 18:33:27.096664300 +0800
+++ d/include/net/bluetooth/l2cap.h	2024-06-17 18:34:47.465834700 +0800
@@ -612,6 +612,7 @@ struct l2cap_chan {
 	void			*data;
 	const struct l2cap_ops	*ops;
 	struct mutex		lock;
+	unsigned int		closed;
 };
 
 struct l2cap_ops {
diff -pur c/net/bluetooth/l2cap_core.c d/net/bluetooth/l2cap_core.c
--- c/net/bluetooth/l2cap_core.c	2024-06-17 18:32:21.249083200 +0800
+++ d/net/bluetooth/l2cap_core.c	2024-06-17 18:35:47.981139900 +0800
@@ -812,6 +812,7 @@ void l2cap_chan_close(struct l2cap_chan
 {
 	struct l2cap_conn *conn = chan->conn;
 
+	chan->closed++;
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
 	switch (chan->state) {
diff -pur c/net/bluetooth/l2cap_sock.c d/net/bluetooth/l2cap_sock.c
--- c/net/bluetooth/l2cap_sock.c	2024-06-17 18:31:43.431535400 +0800
+++ d/net/bluetooth/l2cap_sock.c	2024-06-17 18:41:00.785238900 +0800
@@ -1482,10 +1482,17 @@ static struct l2cap_chan *l2cap_sock_new
 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 {
 	struct sock *sk = chan->data;
-	struct l2cap_pinfo *pi = l2cap_pi(sk);
+	struct l2cap_pinfo *pi;
 	int err;
 
+	l2cap_chan_lock(chan);
+	if (chan->closed) {
+		l2cap_chan_unlock(chan);
+		return -ENOMEM;
+	}
 	lock_sock(sk);
+	pi = l2cap_pi(sk);
+	l2cap_chan_unlock(chan);
 
 	if (chan->mode == L2CAP_MODE_ERTM && !list_empty(&pi->rx_busy)) {
 		err = -ENOMEM;
--