Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)

[Edward Adam Davis]

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 9988ba382b68..afa02e0d7917 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1800,6 +1800,7 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 	hcon->l2cap_data = NULL;
 	conn->hchan = NULL;
 	l2cap_conn_put(conn);
+	cancel_work_sync(&hcon->hdev->rx_work);
 }
 
 static void l2cap_conn_free(struct kref *ref)