Re: [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in l2cap_connect (2)

[Edward Adam Davis]

after release conn, we need to cancle rx_work

#syz test

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index e79cd40bd079..6d95e07d9ddd 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -5499,7 +5499,7 @@ static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
 
 int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
 {
-	int err = 0;
+	int err = 0, failed = 0;
 	u16 handle = conn->handle;
 	bool disconnect = false;
 	struct hci_conn *c;
@@ -5543,10 +5543,13 @@ int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
 		hci_conn_del(conn);
 	} else {
 		hci_conn_failed(conn, reason);
+		failed = 1;
 	}
 
 unlock:
 	hci_dev_unlock(hdev);
+	if (failed)
+		cancel_work_sync(&hdev->rx_work);
 	return err;
 }