From nobody Sat Sep 26 11:49:51 2026 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A4EF3438B9 for ; Wed, 2 Sep 2026 02:11:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=209.85.128.47 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788315065; cv=pass; b=bCs5MmLxT7J11wM4KmjJsKJ1TypLfeZnIU6S1JZljf49i0Asb7Uajn76UfgGQrlGUKICdPWiOi/8uhxgI+ny5OMvL5ssAEpT9y+rhzY2BmtLugG4MJSBngwgv87+v50idkUnLrXTK6w5UbxQLxNrLYJhoNd+YvUNE5wACyvhlm8= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788315065; c=relaxed/simple; bh=Wqi9+7wd5NnLZOWTg5e1HxhEYKd1pgkTsh1j+yGEUio=; h=MIME-Version:From:Date:Message-ID:Subject:To:Cc:Content-Type; b=IrkReUyoEv4jjrQsTRh9z8Qo8G0EF3x9gNcx4itowfPB57O2KnRgqhnZcSExdbXNjTXS4f3D5GoU6akhFOVt1Wl4P/jDAYeQHkMOKsZciGmKdF1SgHm1Pz7zGwgYzufwACup+ZAnsbBGiaRWxPYmrPETLltge8V3BqDDPzZlGjc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=nEKtSy+6; arc=pass smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="nEKtSy+6" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-49b0d8bc2aaso4130175e9.0 for ; Tue, 01 Sep 2026 19:11:00 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788315057; cv=none; d=google.com; s=arc-20260327; b=ian9jVguU8EgrE4bDSIPT7zFMxhHdQMBKDespRPrwWGgsvmChU/XmW96DI6rbELoJ1 0kqoAjNBGbISZuZ29jtf1izUdH/BdOrkiCJbNaC1c2XMeT7fkIvFpuu3hqxnaBxnKxFo S9l5Fl/RO308Bxul042ZWKAHOmL8Jm0U7x5p/LeNx8bKEygcq7vicwtMjIBhTQmqzFfl GpNFwQbQj5nIllQiT7NDYh0GqBJk89/SHfmWJT0a5Crsj5m5iCQL2lFWGqd4eiKpJ1hw OS+l+XZmABxawUxTs1JhnOvDbv36OXZF+INcLqbS/RJwq7ykrtvFU0ckbo0XRVy4BPA9 paEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=miRWNlrgJnkfFijXetq532ldKdfjhWdGeVzZOadUgfM=; fh=NKW+jPmJAZMq6y7OQ+LTEa/zRaTU4u4JIQFfzuInnZI=; b=h31lMGrUaIDYTkQfVlESzPNZDsENmsHBe0erwS+k8NFAf1Nr/8PqdGTUS0uG3kC/fE 1AFBrWMFdw9yZaUCGkDNsWMIKEstZdK/3xVZ1GiyVnY364mrqWTJyKfsoLL6yzT3McMT UmZ/taV4at5m14zha35UV4arFPHNxDhWmYaLmQJrasSRofYk89uBfCdNJhfWZ0oEDiSl 95P7hb+nAj9wRifOl+vovLPePtWun+G/yYu/0muYeQEuVulstaBJzkP5lbIUugXFoFGQ 8b9P5WfLlaF5bLesfhQO09QIpC+nNQEGIG8wjEPGKDSNfUs3ZL1xRoMtBqFv2Ub27qjX Esiw==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788315057; x=1788919857; darn=vger.kernel.org; h=content-type:cc:to:subject:message-id:date:from:mime-version:from :to:cc:subject:date:message-id:reply-to:content-type; bh=miRWNlrgJnkfFijXetq532ldKdfjhWdGeVzZOadUgfM=; b=nEKtSy+6LpmCdTyNs3tkNaHCU95DoaR5d1RLIDhBanxfRE6hdxNMrX5wkA3Q9satGe uZ1VmNgab/vKswXnM79zFI3lvaayb5Z+gfUfhBk0y5RXwSkOQo6AY3Ysw6Nm949F+CS4 WTmulsdsOrRlE8TSUNrh7pZg2eyPTUqVuf3GY7fiTT6RwSKbL9AiaDI75mAQsslCnNmA OiaVAwQ39SaFwnmTP7DGPNGvgFqOWlVQ29rogh/MId6wla5SFotctQQdixwO7RGQP/e8 J8qh46nCD4tG6I6fOqc+TmZ0fvOqc1/jX7vqFCDcAfYjRSxK3LPGoA+cvOB8fB76WK4g uroQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788315057; x=1788919857; h=content-type:cc:to:subject:message-id:date:from:mime-version :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=miRWNlrgJnkfFijXetq532ldKdfjhWdGeVzZOadUgfM=; b=RPMl5WwBtzy43VuhDv3tbMEI+HwsDxr3tJoQrdslTXd3JBDZY0qmhrl3UE3xAmw/o+ EGXoLjt0g931mPdabT3gejfr5MWIEc7+nMvISBPPxL93P3eZFfd30OrY4L6Uv1M7frLs YcoIBP3xbeJegDoivjpJqmNgFWl3G09N2uSlhs0GohLZNwVzjT8QxcN5AsHfeBD5Uc2r /fHAUf3ppDRYfb1h+iUUiC8sV++wWt8P0p/FkPsR7PFpuzvcLombJwUNWELjXgkN/7L8 tpviSGKVN5stFNcnnu66/AyaZALTy/Oq5MS86taSRGAPl5tvpEcaDvW1Ip4sEpP7iwkC RQpw== X-Forwarded-Encrypted: i=1; AHgh+Rr3CWPcE71OjHs/MiskdquPt08hsW9gb+7ZoTWMY47TE+293/86khspp1BNEN23sGMt85ELp+dH6vjDJAc=@vger.kernel.org X-Gm-Message-State: AFuF++m7Q5abcG8dL3LaNeBVIxqG99p++KRIW35nf8q+SbE+DslLBL3h Ir6qLJ63X71sNGlYV70IGmoVe4lAdeDGm1j23aUkH+CvVNzzuUQXlEQn7Hx2t+8ybLiDGV5CKlg eNUK/KiW5/eHHc4bNhg7PH7T5O4/V3oA= X-Gm-Gg: AR+sD10rbTp7d7IiRZ8VcSK0ekCtMdCOuVpeZqtTYsmSPa2aBuiB2gQrjHHUc8Gqe5M FNNzSUuZ3uFQjH5MPIIrwTqgYTWBthzCQYFfCVHaZS1K7jDGjJI6jK7fIZqG0oEkQl5G9nFmPxO 9JoZEvVDYo1qNlUjxiw3dCPt+FDhK6eqCnI/p1Cd186D28MigupscwQcU4Jb/QWX3k02oxBut/X 4EIlcO/oTvAsGG5L8DRU0yWCmuN+RjIA2v/6NS/tNvR6Ys4SC9+lk7YxtWe9SxMx4qo1OL7rJlc mWyJgvUsXEm4fw4/KmSYSki2QKZiOWez0wSt4/SDpKQ= X-Received: by 2002:a05:600c:354b:b0:499:51f0:a9b2 with SMTP id 5b1f17b1804b1-49ce55f051dmr21559675e9.1.1788315057139; Tue, 01 Sep 2026 19:10:57 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 From: Qingyu Zhang Date: Wed, 2 Sep 2026 10:10:45 +0800 X-Gm-Features: AcwNN1VZJvtFR2-aP1IaZVpF82vVv6SRFFNrJZSVY7OUOlEnX_AFIkDT1G5csAM Message-ID: Subject: [BUG] Bluetooth: ISO: listener sock leaked when iso_sock_alloc() fails To: Marcel Holtmann , Luiz Augusto von Dentz Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Hello, iso_conn_ready() leaks a reference on the ISO listening socket when child allocation fails. A patch is attached. Type: memory leak (sock reference) * Summary iso_get_sock() does sock_hold(parent). iso_conn_ready() then: lock_sock(parent); sk =3D iso_sock_alloc(..., GFP_ATOMIC, 0); if (!sk) { release_sock(parent); return; /* missing sock_put(parent) */ } The success path and the "listener closed concurrently" path (after 560bef609fa5) both sock_put(parent). This failure path does not. * Affected Introduced with BTPROTO_ISO (ccf74f2390d6). Still present on 08dbfad3f504. Needs CONFIG_BT=3Dm, CONFIG_BT_ISO, HCI_VHCI, kmemleak and (for a reliable trigger) CONFIG_FAILSLAB. * Reproduction 1. Boot with kmemleak=3Don and failslab. 2. Bring up a virtual controller (hci_vhci). 3. ISO socket: bind + BT_DEFER_SETUP + listen. 4. Inject HCI LE Enhanced Connection Complete, then LE CIS Request (subevent 0x1a) while failslab is armed for GFP_ATOMIC (ignore-gfp-wait=3DY, probability=3D100, times=3D-1) so iso_sock_alloc() returns NULL. 5. close() the listen fd, then: echo scan > /sys/kernel/debug/kmemleak kmemleak shows the listen sock (size 2048, iso_sock_create -> iso_sock_alloc). rmmod bluetooth then fails with EBUSY. PoC: poc/vhci_iso.c (the "#47 failslab GFP_ATOMIC window around CIS_REQ" section). Full QEMU recipe is in poc/run.sh. * Expected iso_sock_alloc() failure drops the iso_get_sock() reference, same as the other return paths in iso_conn_ready(). * Actual sk_refcnt stays elevated. The listen sock is never freed. Please consider the suggested patch. Thanks. Suggested patch: ``` diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 75bfd5938b2e..4de332b8901f 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -2289,6 +2289,7 @@ static void iso_conn_ready(struct iso_conn *conn) BTPROTO_ISO, GFP_ATOMIC, 0); if (!sk) { release_sock(parent); + sock_put(parent); return; } ```