On Fri, Apr 26, 2024 at 03:20:05AM -0400, Sungwoo Kim wrote:
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index 84fc70862..a8f414ab8 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -3953,6 +3953,9 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
> if (!chan)
> goto response;
>
> + l2cap_chan_hold(chan);
> + l2cap_chan_lock(chan);
> +
> /* For certain devices (ex: HID mouse), support for authentication,
> * pairing and bonding is optional. For such devices, inorder to avoid
> * the ACL alive for too long after L2CAP disconnection, reset the ACL
> @@ -4041,6 +4044,11 @@ static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
> chan->num_conf_req++;
> }
>
> + if (chan) {
> + l2cap_chan_unlock(chan);
> + l2cap_chan_put(chan);
> + }
> +
> return chan;
^^^^^^^^^^^^
This doesn't fix the bug because we're returning chan.
As soon as you call l2cap_chan_put() then chan will be freed by in the
other thread which is doing l2cap_conn_del() resulting in a use after
free in the caller.
regards,
dan carpenter
