Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_unregister_user

[Hillf Danton <hdanton@sina.com>]

On Fri, 01 Nov 2024 11:29:21 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    90602c251cda Merge tag 'net-6.12-rc6' of git://git.kernel...
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=15bd9340580000

#syz test

--- l/net/bluetooth/hidp/core.c
+++ y/net/bluetooth/hidp/core.c
@@ -1302,6 +1302,7 @@ static int hidp_session_thread(void *arg
 	 * delete the session.
 	 */
 	l2cap_unregister_user(session->conn, &session->user);
+	hci_dev_put(session->conn->hcon->hdev);
 	hidp_session_put(session);
 
 	module_put_and_kthread_exit(0);
@@ -1378,6 +1379,7 @@ int hidp_connection_add(const struct hid
 	ret = l2cap_register_user(conn, &session->user);
 	if (ret)
 		goto out_session;
+	hci_dev_hold(conn->hcon->hdev);
 
 	ret = 0;
 
@@ -1405,8 +1407,10 @@ int hidp_connection_del(struct hidp_conn
 				       HIDP_TRANS_HID_CONTROL |
 				         HIDP_CTRL_VIRTUAL_CABLE_UNPLUG,
 				       NULL, 0);
-	else
+	else {
 		l2cap_unregister_user(session->conn, &session->user);
+		hci_dev_put(session->conn->hcon->hdev);
+	}
 
 	hidp_session_put(session);
 
--