From: kernel test robot <lkp@intel.com>
To: Sungwoo Kim <iam@sung-woo.kim>
Cc: oe-kbuild-all@lists.linux.dev, wuruoyu@me.com,
benquike@gmail.com, daveti@purdue.edu,
Sungwoo Kim <iam@sung-woo.kim>,
Marcel Holtmann <marcel@holtmann.org>,
Johan Hedberg <johan.hedberg@gmail.com>,
Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
Date: Fri, 26 May 2023 20:01:48 +0800 [thread overview]
Message-ID: <202305261912.mKLcy6Fw-lkp@intel.com> (raw)
In-Reply-To: <20230526084038.2199788-1-iam@sung-woo.kim>
Hi Sungwoo,
kernel test robot noticed the following build errors:
[auto build test ERROR on bluetooth/master]
[also build test ERROR on bluetooth-next/master linus/master v6.4-rc3 next-20230525]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Sungwoo-Kim/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_ready_cb/20230526-164241
base: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth.git master
patch link: https://lore.kernel.org/r/20230526084038.2199788-1-iam%40sung-woo.kim
patch subject: [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20230526/202305261912.mKLcy6Fw-lkp@intel.com/config)
compiler: powerpc-linux-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
mkdir -p ~/bin
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/c0c02b1afbe2667fe21aed47375c4e0d45713f38
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Sungwoo-Kim/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_ready_cb/20230526-164241
git checkout c0c02b1afbe2667fe21aed47375c4e0d45713f38
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 ~/bin/make.cross W=1 O=build_dir ARCH=powerpc olddefconfig
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 ~/bin/make.cross W=1 O=build_dir ARCH=powerpc SHELL=/bin/bash net/bluetooth/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202305261912.mKLcy6Fw-lkp@intel.com/
All error/warnings (new ones prefixed by >>):
net/bluetooth/l2cap_sock.c: In function 'l2cap_sock_release':
>> net/bluetooth/l2cap_sock.c:1418:9: error: implicit declaration of function 'l2cap_sock_cleanup_listen'; did you mean 'l2cap_sock_listen'? [-Werror=implicit-function-declaration]
1418 | l2cap_sock_cleanup_listen(sk);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
| l2cap_sock_listen
net/bluetooth/l2cap_sock.c: At top level:
>> net/bluetooth/l2cap_sock.c:1436:13: warning: conflicting types for 'l2cap_sock_cleanup_listen'; have 'void(struct sock *)'
1436 | static void l2cap_sock_cleanup_listen(struct sock *parent)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
>> net/bluetooth/l2cap_sock.c:1436:13: error: static declaration of 'l2cap_sock_cleanup_listen' follows non-static declaration
net/bluetooth/l2cap_sock.c:1418:9: note: previous implicit declaration of 'l2cap_sock_cleanup_listen' with type 'void(struct sock *)'
1418 | l2cap_sock_cleanup_listen(sk);
| ^~~~~~~~~~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +1418 net/bluetooth/l2cap_sock.c
1406
1407 static int l2cap_sock_release(struct socket *sock)
1408 {
1409 struct sock *sk = sock->sk;
1410 int err;
1411 struct l2cap_chan *chan;
1412
1413 BT_DBG("sock %p, sk %p", sock, sk);
1414
1415 if (!sk)
1416 return 0;
1417
> 1418 l2cap_sock_cleanup_listen(sk);
1419 bt_sock_unlink(&l2cap_sk_list, sk);
1420
1421 err = l2cap_sock_shutdown(sock, SHUT_RDWR);
1422 chan = l2cap_pi(sk)->chan;
1423
1424 l2cap_chan_hold(chan);
1425 l2cap_chan_lock(chan);
1426
1427 sock_orphan(sk);
1428 l2cap_sock_kill(sk);
1429
1430 l2cap_chan_unlock(chan);
1431 l2cap_chan_put(chan);
1432
1433 return err;
1434 }
1435
> 1436 static void l2cap_sock_cleanup_listen(struct sock *parent)
1437 {
1438 struct sock *sk;
1439
1440 BT_DBG("parent %p state %s", parent,
1441 state_to_string(parent->sk_state));
1442
1443 /* Close not yet accepted channels */
1444 while ((sk = bt_accept_dequeue(parent, NULL))) {
1445 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1446
1447 BT_DBG("child chan %p state %s", chan,
1448 state_to_string(chan->state));
1449
1450 l2cap_chan_hold(chan);
1451 l2cap_chan_lock(chan);
1452
1453 __clear_chan_timer(chan);
1454 l2cap_chan_close(chan, ECONNRESET);
1455 l2cap_sock_kill(sk);
1456
1457 l2cap_chan_unlock(chan);
1458 l2cap_chan_put(chan);
1459 }
1460 }
1461
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2023-05-26 12:02 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-05-26 8:40 [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Sungwoo Kim
2023-05-26 12:01 ` kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2023-02-02 12:09 [PATCH] Bluetooth: L2CAP: Fix use-after-free Sungwoo Kim
2023-05-26 18:16 ` [PATCH] Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb Sungwoo Kim
2023-05-27 12:59 ` Simon Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202305261912.mKLcy6Fw-lkp@intel.com \
--to=lkp@intel.com \
--cc=benquike@gmail.com \
--cc=daveti@purdue.edu \
--cc=iam@sung-woo.kim \
--cc=johan.hedberg@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luiz.dentz@gmail.com \
--cc=marcel@holtmann.org \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=wuruoyu@me.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).