Re: [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb

[kernel test robot]

Hi Sungwoo,

kernel test robot noticed the following build errors:

[auto build test ERROR on bluetooth/master]
[also build test ERROR on bluetooth-next/master linus/master v6.4-rc3 next-20230525]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Sungwoo-Kim/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_ready_cb/20230526-164241
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git master
patch link:    https://lore.kernel.org/r/20230526084038.2199788-1-iam%40sung-woo.kim
patch subject: [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20230526/202305261912.mKLcy6Fw-lkp@xxxxxxxxx/config)
compiler: powerpc-linux-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
        mkdir -p ~/bin
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/intel-lab-lkp/linux/commit/c0c02b1afbe2667fe21aed47375c4e0d45713f38
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Sungwoo-Kim/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_ready_cb/20230526-164241
        git checkout c0c02b1afbe2667fe21aed47375c4e0d45713f38
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 ~/bin/make.cross W=1 O=build_dir ARCH=powerpc olddefconfig
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 ~/bin/make.cross W=1 O=build_dir ARCH=powerpc SHELL=/bin/bash net/bluetooth/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202305261912.mKLcy6Fw-lkp@xxxxxxxxx/

All error/warnings (new ones prefixed by >>):

   net/bluetooth/l2cap_sock.c: In function 'l2cap_sock_release':
>> net/bluetooth/l2cap_sock.c:1418:9: error: implicit declaration of function 'l2cap_sock_cleanup_listen'; did you mean 'l2cap_sock_listen'? [-Werror=implicit-function-declaration]
    1418 |         l2cap_sock_cleanup_listen(sk);
         |         ^~~~~~~~~~~~~~~~~~~~~~~~~
         |         l2cap_sock_listen
   net/bluetooth/l2cap_sock.c: At top level:
>> net/bluetooth/l2cap_sock.c:1436:13: warning: conflicting types for 'l2cap_sock_cleanup_listen'; have 'void(struct sock *)'
    1436 | static void l2cap_sock_cleanup_listen(struct sock *parent)
         |             ^~~~~~~~~~~~~~~~~~~~~~~~~
>> net/bluetooth/l2cap_sock.c:1436:13: error: static declaration of 'l2cap_sock_cleanup_listen' follows non-static declaration
   net/bluetooth/l2cap_sock.c:1418:9: note: previous implicit declaration of 'l2cap_sock_cleanup_listen' with type 'void(struct sock *)'
    1418 |         l2cap_sock_cleanup_listen(sk);
         |         ^~~~~~~~~~~~~~~~~~~~~~~~~
   cc1: some warnings being treated as errors


vim +1418 net/bluetooth/l2cap_sock.c

  1406	
  1407	static int l2cap_sock_release(struct socket *sock)
  1408	{
  1409		struct sock *sk = sock->sk;
  1410		int err;
  1411		struct l2cap_chan *chan;
  1412	
  1413		BT_DBG("sock %p, sk %p", sock, sk);
  1414	
  1415		if (!sk)
  1416			return 0;
  1417	
> 1418		l2cap_sock_cleanup_listen(sk);
  1419		bt_sock_unlink(&l2cap_sk_list, sk);
  1420	
  1421		err = l2cap_sock_shutdown(sock, SHUT_RDWR);
  1422		chan = l2cap_pi(sk)->chan;
  1423	
  1424		l2cap_chan_hold(chan);
  1425		l2cap_chan_lock(chan);
  1426	
  1427		sock_orphan(sk);
  1428		l2cap_sock_kill(sk);
  1429	
  1430		l2cap_chan_unlock(chan);
  1431		l2cap_chan_put(chan);
  1432	
  1433		return err;
  1434	}
  1435	
> 1436	static void l2cap_sock_cleanup_listen(struct sock *parent)
  1437	{
  1438		struct sock *sk;
  1439	
  1440		BT_DBG("parent %p state %s", parent,
  1441		       state_to_string(parent->sk_state));
  1442	
  1443		/* Close not yet accepted channels */
  1444		while ((sk = bt_accept_dequeue(parent, NULL))) {
  1445			struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  1446	
  1447			BT_DBG("child chan %p state %s", chan,
  1448			       state_to_string(chan->state));
  1449	
  1450			l2cap_chan_hold(chan);
  1451			l2cap_chan_lock(chan);
  1452	
  1453			__clear_chan_timer(chan);
  1454			l2cap_chan_close(chan, ECONNRESET);
  1455			l2cap_sock_kill(sk);
  1456	
  1457			l2cap_chan_unlock(chan);
  1458			l2cap_chan_put(chan);
  1459		}
  1460	}
  1461	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki