Hi Sungwoo, kernel test robot noticed the following build errors: [auto build test ERROR on bluetooth/master] [also build test ERROR on bluetooth-next/master linus/master v6.4-rc3 next-20230525] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Sungwoo-Kim/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_ready_cb/20230526-164241 base: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git master patch link: https://lore.kernel.org/r/20230526084038.2199788-1-iam%40sung-woo.kim patch subject: [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20230526/202305261912.mKLcy6Fw-lkp@xxxxxxxxx/config) compiler: powerpc-linux-gcc (GCC) 12.1.0 reproduce (this is a W=1 build): mkdir -p ~/bin wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/c0c02b1afbe2667fe21aed47375c4e0d45713f38 git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Sungwoo-Kim/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_ready_cb/20230526-164241 git checkout c0c02b1afbe2667fe21aed47375c4e0d45713f38 # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 ~/bin/make.cross W=1 O=build_dir ARCH=powerpc olddefconfig COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 ~/bin/make.cross W=1 O=build_dir ARCH=powerpc SHELL=/bin/bash net/bluetooth/ If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Closes: https://lore.kernel.org/oe-kbuild-all/202305261912.mKLcy6Fw-lkp@xxxxxxxxx/ All error/warnings (new ones prefixed by >>): net/bluetooth/l2cap_sock.c: In function 'l2cap_sock_release': >> net/bluetooth/l2cap_sock.c:1418:9: error: implicit declaration of function 'l2cap_sock_cleanup_listen'; did you mean 'l2cap_sock_listen'? [-Werror=implicit-function-declaration] 1418 | l2cap_sock_cleanup_listen(sk); | ^~~~~~~~~~~~~~~~~~~~~~~~~ | l2cap_sock_listen net/bluetooth/l2cap_sock.c: At top level: >> net/bluetooth/l2cap_sock.c:1436:13: warning: conflicting types for 'l2cap_sock_cleanup_listen'; have 'void(struct sock *)' 1436 | static void l2cap_sock_cleanup_listen(struct sock *parent) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> net/bluetooth/l2cap_sock.c:1436:13: error: static declaration of 'l2cap_sock_cleanup_listen' follows non-static declaration net/bluetooth/l2cap_sock.c:1418:9: note: previous implicit declaration of 'l2cap_sock_cleanup_listen' with type 'void(struct sock *)' 1418 | l2cap_sock_cleanup_listen(sk); | ^~~~~~~~~~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors vim +1418 net/bluetooth/l2cap_sock.c 1406 1407 static int l2cap_sock_release(struct socket *sock) 1408 { 1409 struct sock *sk = sock->sk; 1410 int err; 1411 struct l2cap_chan *chan; 1412 1413 BT_DBG("sock %p, sk %p", sock, sk); 1414 1415 if (!sk) 1416 return 0; 1417 > 1418 l2cap_sock_cleanup_listen(sk); 1419 bt_sock_unlink(&l2cap_sk_list, sk); 1420 1421 err = l2cap_sock_shutdown(sock, SHUT_RDWR); 1422 chan = l2cap_pi(sk)->chan; 1423 1424 l2cap_chan_hold(chan); 1425 l2cap_chan_lock(chan); 1426 1427 sock_orphan(sk); 1428 l2cap_sock_kill(sk); 1429 1430 l2cap_chan_unlock(chan); 1431 l2cap_chan_put(chan); 1432 1433 return err; 1434 } 1435 > 1436 static void l2cap_sock_cleanup_listen(struct sock *parent) 1437 { 1438 struct sock *sk; 1439 1440 BT_DBG("parent %p state %s", parent, 1441 state_to_string(parent->sk_state)); 1442 1443 /* Close not yet accepted channels */ 1444 while ((sk = bt_accept_dequeue(parent, NULL))) { 1445 struct l2cap_chan *chan = l2cap_pi(sk)->chan; 1446 1447 BT_DBG("child chan %p state %s", chan, 1448 state_to_string(chan->state)); 1449 1450 l2cap_chan_hold(chan); 1451 l2cap_chan_lock(chan); 1452 1453 __clear_chan_timer(chan); 1454 l2cap_chan_close(chan, ECONNRESET); 1455 l2cap_sock_kill(sk); 1456 1457 l2cap_chan_unlock(chan); 1458 l2cap_chan_put(chan); 1459 } 1460 } 1461 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
