Re: [PATCH net-next v3 2/9] Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()

[Eric Dumazet]

On Mon, Oct 14, 2024 at 11:23 PM Kuniyuki Iwashima <kuniyu@xxxxxxxxxx> wrote:
>
> From: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
> Date: Mon, 14 Oct 2024 16:38:01 +0100
> > bt_sock_alloc() allocates the sk object and attaches it to the provided
> > sock object. On error l2cap_sock_alloc() frees the sk object, but the
> > dangling pointer is still attached to the sock object, which may create
> > use-after-free in other code.
> >
> > Signed-off-by: Ignat Korchagin <ignat@xxxxxxxxxxxxxx>
>
> Reviewed-by: Kuniyuki Iwashima <kuniyu@xxxxxxxxxx>
>
> Checked all bt_sock_alloc() paths and confirmed only rfcomm and l2cap
> need changes.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>