Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_unregister_user

Hillf Danton
2024-11-02T01:27:31Z

On Fri, 01 Nov 2024 11:29:21 -0700
> syzbot found the following issue on:
>
> HEAD commit: 90602c251cda Merge tag 'net-6.12-rc6' of git://git.kernel...
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15bd9340580000

#syz test

--- l/net/bluetooth/hidp/core.c
+++ y/net/bluetooth/hidp/core.c
@@ -1302,6 +1302,7 @@ static int hidp_session_thread(void *arg
* delete the session.
*/
l2cap_unregister_user(session->conn, &session->user);
+ hci_dev_put(session->conn->hcon->hdev);
hidp_session_put(session);

module_put_and_kthread_exit(0);
@@ -1378,6 +1379,7 @@ int hidp_connection_add(const struct hid
ret = l2cap_register_user(conn, &session->user);
if (ret)
goto out_session;
+ hci_dev_hold(conn->hcon->hdev);

ret = 0;

@@ -1405,8 +1407,10 @@ int hidp_connection_del(struct hidp_conn
HIDP_TRANS_HID_CONTROL |
HIDP_CTRL_VIRTUAL_CABLE_UNPLUG,
NULL, 0);
- else
+ else {
l2cap_unregister_user(session->conn, &session->user);
+ hci_dev_put(session->conn->hcon->hdev);
+ }

hidp_session_put(session);

--