Re: [syzbot] [bluetooth?] possible deadlock in l2cap_chan_connect (2)

[Hillf Danton]

> Date: Tue, 06 Oct 2026 09:19:25 -0700
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    2c3418fffa9d Merge tag 'keys-v7.3-rc7' of git://git.kernel..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17ca6ff5580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=929e4854a828f434
> dashboard link: https://syzkaller.appspot.com/bug?extid=1fed874be1d7e459b5a3
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=101e6f25580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13cfbff5580000

#syz test

--- x/net/bluetooth/rfcomm/core.c
+++ y/net/bluetooth/rfcomm/core.c
@@ -42,6 +42,7 @@ static int channel_mtu = -1;
 
 static struct task_struct *rfcomm_thread;
 
+static DEFINE_MUTEX(rfcomm_cb_mutex);
 static DEFINE_MUTEX(rfcomm_mutex);
 #define rfcomm_lock()	mutex_lock(&rfcomm_mutex)
 #define rfcomm_unlock()	mutex_unlock(&rfcomm_mutex)
@@ -701,7 +702,9 @@ static struct rfcomm_session *rfcomm_ses
 			return NULL;
 		}
 
+	mutex_lock(&rfcomm_cb_mutex);
 	list_add(&s->list, &session_list);
+	mutex_unlock(&rfcomm_cb_mutex);
 
 	return s;
 }
@@ -743,6 +746,7 @@ static struct rfcomm_session *rfcomm_ses
 {
 	struct rfcomm_dlc *d, *n;
 
+	mutex_lock(&rfcomm_cb_mutex);
 	s->state = BT_CLOSED;
 
 	BT_DBG("session %p state %ld err %d", s, s->state, err);
@@ -754,7 +758,9 @@ static struct rfcomm_session *rfcomm_ses
 	}
 
 	rfcomm_session_clear_timer(s);
-	return rfcomm_session_del(s);
+	s = rfcomm_session_del(s);
+	mutex_unlock(&rfcomm_cb_mutex);
+	return s;
 }
 
 static struct rfcomm_session *rfcomm_session_create(bdaddr_t *src,
@@ -2220,11 +2226,11 @@ static void rfcomm_security_cfm(struct h
 
 	BT_DBG("conn %p status 0x%02x encrypt 0x%02x", conn, status, encrypt);
 
-	rfcomm_lock();
+	mutex_lock(&rfcomm_cb_mutex);
 
 	s = rfcomm_session_get(&conn->hdev->bdaddr, &conn->dst);
 	if (!s) {
-		rfcomm_unlock();
+		mutex_unlock(&rfcomm_cb_mutex);
 		return;
 	}
 
@@ -2258,7 +2264,7 @@ static void rfcomm_security_cfm(struct h
 			set_bit(RFCOMM_AUTH_REJECT, &d->flags);
 	}
 
-	rfcomm_unlock();
+	mutex_unlock(&rfcomm_cb_mutex);
 
 	rfcomm_schedule();
 }
--