On 26 Sep 2022 09:43:42 -0700 > syzbot found the following issue on: > > HEAD commit: aaa11ce2ffc8 Add linux-next specific files for 20220923 > git tree: linux-next > console+strace: https://syzkaller.appspot.com/x/log.txt?x=14b32754880000 > kernel config: https://syzkaller.appspot.com/x/.config?x=186d1ff305f10294 > dashboard link: https://syzkaller.appspot.com/bug?extid=03450dacbc626061c3a3 > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12d389c4880000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14269e38880000 Put refcount in balance for channel in bid to fix uaf. #syz test https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git aaa11ce2ffc8 --- a/net/bluetooth/a2mp.c +++ b/net/bluetooth/a2mp.c @@ -896,6 +896,8 @@ struct l2cap_chan *a2mp_channel_create(s BT_ERR("Could not create AMP manager"); return NULL; } + /* pair with put in l2cap_data_channel() */ + l2cap_chan_hold(mgr->a2mp_chan); BT_DBG("mgr: %p chan %p", mgr, mgr->a2mp_chan); --
