Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4297-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Content-Type: text/plain; charset="utf-8"
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Subject: Re: [PATCH] Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
From: patchwork-bot+bluetooth@kernel.org
Message-Id: 
 <171475562973.29614.6591900788209831933.git-patchwork-notify@kernel.org>
Date: Fri, 03 May 2024 17:00:29 +0000
References: <20240502125736.28034-1-duoming@zju.edu.cn>
In-Reply-To: <20240502125736.28034-1-duoming@zju.edu.cn>
To: Duoming Zhou <duoming@zju.edu.cn>
Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org,
 luiz.dentz@gmail.com, johan.hedberg@gmail.com, marcel@holtmann.org

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu,  2 May 2024 20:57:36 +0800 you wrote:
> There is a race condition between l2cap_chan_timeout() and
> l2cap_chan_del(). When we use l2cap_chan_del() to delete the
> channel, the chan->conn will be set to null. But the conn could
> be dereferenced again in the mutex_lock() of l2cap_chan_timeout().
> As a result the null pointer dereference bug will happen. The
> KASAN report triggered by POC is shown below:
> 
> [...]

Here is the summary with links:
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
    https://git.kernel.org/bluetooth/bluetooth-next/c/8192cea84c6c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html