From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp153-171.sina.com.cn (smtp153-171.sina.com.cn [61.135.153.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 769423403E1 for ; Tue, 21 Jul 2026 04:29:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=61.135.153.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784608165; cv=none; b=uV/aiBVZTTKIHiylueMDj+g15pGMD5HWF3r+W1v1xzI1LhEoSqaF7VE10XCT5hOQfWncGscUbyV4C1uLj3ob59abST+J3e4NI7YsZYrpCB4xjc5EywOIgJJ7K4zeHBwuoJyX4IcqQQAiwDU57/9/WHoXXvtoFs51dTdAmWoyx5I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784608165; c=relaxed/simple; bh=yilz5Gl7AjKKBiGAgt8wsOUmGwgMUdCM8Lc/2w7KLqE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IK27nD6sJ5oG9w6pOGk3+3KBtFbF2xre+jXIiXFR1CqhLdTQ61flXmsv22kOjPAdw5wFZbE2exCn1Dn6zTzi865td1CfRJh4xOWFSKrfGSjcb1Fp9qaW2BlMjKTp34X4D0va9mGWAeP+uYnOE8DntDwTWYycDC51YQR5cS/k41c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=JZlpybqa; arc=none smtp.client-ip=61.135.153.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="JZlpybqa" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1784608158; bh=ltG73VA2es4BJ+6vdUG6KXOVtPQ8R+GlzWhAQ251VNc=; h=From:Subject:Date:Message-ID; b=JZlpybqabdpG1FkWI5dtW0C3nAvfWa7nLNAF9lNFdCpZW0+qOBUcdB311/dNayXL7 rTR7fMIXmbgNldaIDAAJKMJShLL+WR0FbvLLFBRo+1fyqyB2b6vErNzy/lBqO/uDrF anho+HItH7on3IAWRREP9gWikKDy9w3w+3ljPZ8A= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([221.216.152.105]) by sina.com (10.54.253.34) with ESMTP id 6A5EF50400005C3B; Tue, 21 Jul 2026 12:26:48 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 160596292155 X-SMAIL-UIID: E451ACFEECD34D269C27204C3C7AA469-20260721-122648-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in l2cap_chan_hold_unless_zero Date: Tue, 21 Jul 2026 12:26:33 +0800 Message-ID: <20260721042635.643-1-hdanton@sina.com> In-Reply-To: <6a5eb5ab.42649fcc.6186.008b.GAE@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit > Date: Mon, 20 Jul 2026 16:56:27 -0700 > Hello, > > syzbot found the following issue on: > > HEAD commit: e22254e9ddd8 Merge tag 'xfs-fixes-7.2-rc4' of git://git.ke.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=13d46789580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=48ef5c5c0f192153 > dashboard link: https://syzkaller.appspot.com/bug?extid=e6382a2f53f5fc7453ac > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17b434b9580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17d46789580000 #syz test --- x/net/bluetooth/l2cap_sock.c +++ y/net/bluetooth/l2cap_sock.c @@ -1532,7 +1532,9 @@ static void l2cap_sock_cleanup_listen(st struct l2cap_chan *chan; lock_sock_nested(sk, L2CAP_NESTING_NORMAL); - chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); + chan = l2cap_pi(sk)->chan; + if (chan) + chan = l2cap_chan_hold_unless_zero(l2cap_pi(sk)->chan); release_sock(sk); if (!chan) { /* l2cap_conn_del() already tearing this child down */ --