From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5036C38E11A; Fri, 24 Jul 2026 20:20:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924451; cv=pass; b=Io0Xn9b3wfd+SGZ5gl3lePqKoR12b0GENSYHa7Q0uAAVV5PeesP8A4yp4LvT78PEKJ97O0LFFrgKH1m1tQt+9PZecypKpZyeVLRgjlNeZSS0GUuHOskfG6wrD4BVfkGU5PW7AswIfKZqY1xipoaa9I83xlREZXvQgtURbQOnz5s= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924451; c=relaxed/simple; bh=sJmTyEermAhBWh1DBtQKsgekpmah+gX4k4+EUtQvrKQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fqsmtY8YghcYB0Eb4zaHGiyA7beWgP1XWsVOAk7LOqbd6DAvUX/K4wPHLecrTr4xvUJubuisusIdpFQKg6zVI7+dAcRodgzIeTX8Z379IMTB/Oqp4GoFjn6eq94Iq99XrSJW7TwjWiHBz7h1vgcvIsIxAFI7oacHjuREErq/D+0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=mDQ6VEXl; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="mDQ6VEXl" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KB15PmKzyVm; Fri, 24 Jul 2026 23:20:41 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924442; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gYo35VvXbcvCZTkQ9fLtntLwksh1qmIBWoVZSEABaVw=; b=mDQ6VEXlEN8Lh4oAETCnJIb1vG1bsaVnR9jW48YvPgMz7THu6ix6l+9cpAqiww/ECyQAlU LFwxQEmFsZLIjescEYm2LPLrJneg8DwXy4fd4mvTUwWRnidy64O+0R12RZyaxA/7rJuPdu GHRIvpGGqiyOuDXEPMvKWPKes4vQE00= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924442; b=aAu/ELXpX4Lpjg4l75gcvtpMJSAch8RWQJIS9YgIh2cvLXXEoxfgbo/S+kUR7+v3DsePOX OchBMd7xjDS0AxBtHIRA7yCpgwIDC615heKXPcwXCABFuLqfj1JAXOVqaIis9hCcsYMW1B Xsw2/90HR8NG6VYfdYYmMXdGuoHw8Hw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924442; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=gYo35VvXbcvCZTkQ9fLtntLwksh1qmIBWoVZSEABaVw=; b=e29qeXBzZPfsb6YKeRUAZqpzVrfOy8Y1Z4e2bZXQlJkxE1lBl64qo2YeOCKqO0pB8wM/jA b8n3u0F131ZA/Nomq/y0VlpWFJOCe6cJAIJcpPV+SEidxLN9Jp6KvcujuVExDXMZ/Hpap3 UVPPMF+VzfXG1n6gi1lJqGFRLHENSDE= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 01/11] Bluetooth: ISO: fix CONNECTED -> CLOSED transition on shutdown/release Date: Fri, 24 Jul 2026 23:20:24 +0300 Message-ID: <0a86ca1839556192d402317eba371d6cba3660cc.1784923689.git.pav@iki.fi> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Commit e824c0bbe0ec ("Bluetooth: ISO: clear iso_data always when detaching = conn from hcon") merged a version of the UAF fix that breaks releasing connected ISO sockets. Since hci_conn::iso_data is set to NULL, iso_chan_del() won't be called when the hci_conn disconnects, and the ISO socket does not emit POLLHUP correctly. Fix by retaining full hci_conn <-> iso_conn association while in BT_DISCONNECT state, so that local disconnect via shutdown() follows similar ISO socket code path as remote disconnect. Use a separate flag to track whether hci_conn_drop() is needed, instead of setting iso_conn::hcon =3D NULL In iso_sock_ready(), disallow disconnecting socket going BT_CONNECTED, in case hcon connects while its drop is pending. Fixes: e824c0bbe0ec ("Bluetooth: ISO: clear iso_data always when detaching = conn from hcon") Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync a= nd BIG sync") Signed-off-by: Pauli Virtanen --- Notes: This is rebased version of and supercedes =20 https://lore.kernel.org/linux-bluetooth/fbd9dd573bb1ce5f38370128dd35447= e2ddfed9c.1784625576.git.pav@iki.fi/ net/bluetooth/iso.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index babba61eb335..299a9336b5e1 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -24,8 +24,14 @@ static struct bt_sock_list iso_sk_list =3D { }; =20 /* ---- ISO connections ---- */ +enum { + ISO_CONN_DROPPED, + __ISO_CONN_NUM_FLAGS +}; + struct iso_conn { struct hci_conn *hcon; + DECLARE_BITMAP(flags, __ISO_CONN_NUM_FLAGS); =20 /* @lock: spinlock protecting changes to iso_conn fields */ spinlock_t lock; @@ -107,7 +113,8 @@ static void iso_conn_free(struct kref *ref) =20 if (conn->hcon) { conn->hcon->iso_data =3D NULL; - hci_conn_drop(conn->hcon); + if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) + hci_conn_drop(conn->hcon); } =20 /* Ensure no more work items will run since hci_conn has been dropped */ @@ -306,6 +313,7 @@ static int __iso_chan_add(struct iso_conn *conn, struct= sock *sk, =20 iso_pi(sk)->conn =3D conn; conn->sk =3D sk; + clear_bit(ISO_CONN_DROPPED, conn->flags); =20 if (parent) bt_accept_enqueue(parent, sk, true); @@ -835,11 +843,8 @@ static void iso_sock_disconn(struct sock *sk) } =20 sk->sk_state =3D BT_DISCONN; - iso_conn_lock(iso_pi(sk)->conn); - hci_conn_drop(iso_pi(sk)->conn->hcon); - iso_pi(sk)->conn->hcon->iso_data =3D NULL; - iso_pi(sk)->conn->hcon =3D NULL; - iso_conn_unlock(iso_pi(sk)->conn); + if (!test_and_set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags)) + hci_conn_drop(iso_pi(sk)->conn->hcon); } =20 static void __iso_sock_close(struct sock *sk) @@ -2042,9 +2047,18 @@ static void iso_sock_ready(struct sock *sk) return; =20 lock_sock(sk); + + switch (sk->sk_state) { + case BT_DISCONN: + case BT_CLOSED: + release_sock(sk); + return; + } + iso_sock_clear_timer(sk); sk->sk_state =3D BT_CONNECTED; sk->sk_state_change(sk); + release_sock(sk); } =20 --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E3593B1ED0; Fri, 24 Jul 2026 20:20:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924453; cv=pass; b=ZmIvW5GnMis88hgzkp7wXFQRXgsA1mjMRsz91vfiLxWKDxdWJSx5yLIEXZsx78QK1LU9h4R2tcCxyL4kxCSuKwPQZ5W1wzBiFB80R3GPF7oAnf7S8w67dCQJ0qAuLC9kWH3fbKbMjosW5zhmL+Ny9/UrlSDNAxh7cLHYNzZgRsM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924453; c=relaxed/simple; bh=ALR5Hey1h7iT4ay7fhEOxY6T8Ih4UpfalhKZjCGkCTA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mzOj/AXDteEdqoeLXjQ5UD3ANw4NdPbJJV12lnQZWgNCKAb0Dsxap+nOAhih9gbXSaftH0UA+L6mDVxF0C9xa2i34pQ8iGEmiXpOvi2BXynHl9fSfZMi516E3ZFZmEs0PDYjJMkh2TqA1peEL854EtpTiV0Q8eD59G3Pupkdx1s= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=m886MbvH; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="m886MbvH" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KB3437HzyWH; Fri, 24 Jul 2026 23:20:43 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O3bRRtWRb6d2zGegRge4CYAsYPMzrVUU76L0leF7cPA=; b=m886MbvHyH8eM4mWLxOFFuwkjCCRyhbtqh0+5Gaa3iaw7/H/YlT65/nt4LfLeZfVo8dvdt sZ/FlQShXAoA+IXdXi80te13bJPRyOkkcqBFOEmC2e2ckzLERIOmiOs3+1iJi08wMgowK/ VMgvBcX7Eq9CvEK5NnAGw7xiPg9Ezlk= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924444; b=iUZjDXQ1ZQ1deACwk6/toTEjuu0mdJl3jdno5dBGdyioDdUKaZ/i+VA7lZl1ihS/JjtEbc QGqjWz+Kx3mCWUEPk2UGKXKSQ2kMP9Hl0IoUqxSdwdEOC0zuEwTV/XBxT6wBUHlZO4D+yw iS+94IYmrGPQS6BggUV3DLe1Wqfgly0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924444; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=O3bRRtWRb6d2zGegRge4CYAsYPMzrVUU76L0leF7cPA=; b=ZT9LefE4wUkoUkgh/gQfglbDr0UnE5nmVTrlFOzsirwXPkOilv+7sqo1Qwcnep+7mEBC9Z /NPvjh5ZO/pHZsOY3ImrhFi7UkEkk3gsCoQNnTsL1aoDxRxTEvf1CRGScX2TuREUsgaQ0+ 3DmAzyKjeuAGwKlVqW/9bSDdNvKJbEs= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 02/11] Bluetooth: ISO: lock sk in iso_sock_getname Date: Fri, 24 Jul 2026 23:20:25 +0300 Message-ID: <868ddc69b94f3bae21707ac898cf4c385797adae.1784923689.git.pav@iki.fi> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Accessing iso_pi(sk)->conn requires lock_sock, which is not held here. Fix by adding the lock/release. Fixes: 2df108c227b2 ("Bluetooth: ISO: Fix using BT_SK_PA_SYNC to detect BIS= sockets") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 299a9336b5e1..dbb8f43052f0 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1472,6 +1472,8 @@ static int iso_sock_getname(struct socket *sock, stru= ct sockaddr *addr, =20 BT_DBG("sock %p, sk %p", sock, sk); =20 + lock_sock(sk); + addr->sa_family =3D AF_BLUETOOTH; =20 if (peer) { @@ -1493,6 +1495,8 @@ static int iso_sock_getname(struct socket *sock, stru= ct sockaddr *addr, sa->iso_bdaddr_type =3D iso_pi(sk)->src_type; } =20 + release_sock(sk); + return len; } =20 --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E5833B27DF; Fri, 24 Jul 2026 20:20:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924460; cv=pass; b=MYDVHK9GD5ZunomE6Hnbg2h4fkLmueLd8ou5EfECqBA88H9w2NLetYR8iTpqFQHf6DZWONERRZvUH8I08bZgijF5tR1xXSTSeAiVW2kTNoviAS6gd0b9J3Ty5McByIwkVvMp2Gz6Kb37pY/5F41xNGFvQL9JUgpCM/hDYRJdV44= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924460; c=relaxed/simple; bh=1SpN3PbpJCN8EML1itNSGAUvXEydaaKunkKHi3Z5w+A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eh3oPBr9/RrAYETBVmaM8qG3uZGfZDQjY9poeNeqSSGf9uE3YOWuZiE+7I6hdMBwLfndeHU06mNpvleW9DRwzdvn15p1zozoUICogyrb7Z97KHaqvkPJq/4TYxrqGBdfAppiOBI9k2WNpLSTgt+4y5CNLBO7RHaZpoN6EWy9mZc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=k4h00+Ue; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="k4h00+Ue" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KB52KzMzyZH; Fri, 24 Jul 2026 23:20:45 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=k23S5RWRNobKoWy+fSjoSzTYLBv9zc75015Aso7VPxg=; b=k4h00+Ue5PK0fKZ/M9QJEMTs40x5fOc0pB+grNUeDRhN7YWehqsIgvIv6EWpsAs8M4H4oG MFp9wnriX/WjFLXpuYdr8yddQSXX8hD3KKPLiYpTaXD9U1oJOcBesJFJMFBQZZtECc+8VN 02JNbAWz89cp0ypXNndUF/jIMcCQaxM= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924446; b=mQmdP2NpnRBSNqnN7hJQ1sH0TpnCcqIIuKBqeUTgh9Ex4bYD90KR26lCe7qVUgq8QB8Zl2 gYw6pg/U2MLLT2MF4JEIxJ8PrsJkqp2MI/sqeEJ4P+5TCBlqwZ4c3d5kBj/M5c/Yb4Fag1 QblKb43jYIt541ChqnMy0TSmqrmNsOU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=k23S5RWRNobKoWy+fSjoSzTYLBv9zc75015Aso7VPxg=; b=ijCG6OrhtoSYZqUVcUyHQNct2TlMuQDK29texEJX6GpA+sei+E3iLV9JNhqzEa6pBJKk4c kBBp8RvdziSB2/t+FgpqnWjfFR1QSfSJGOEKegUUvOznYvbPWl/xLKqidCEpDeW0GI/Bj6 mLnYxeKsx+xtFSFiN94JgSag7hgmJuE= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 03/11] Bluetooth: ISO: lock sk in iso_connect_ind Date: Fri, 24 Jul 2026 23:20:26 +0300 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the "ev3" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking. Fix by adding lock/release. Recheck hcon is valid after lock acquire where needed. Fixes: 168d9bf9c7f0 ("Bluetooth: ISO: Reassemble PA data for bcast sink") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index dbb8f43052f0..651661833966 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -2369,7 +2369,7 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *b= daddr, __u8 *flags) =20 lock_sock(sk); =20 - hcon =3D iso_pi(sk)->conn->hcon; + hcon =3D iso_pi(sk)->conn ? iso_pi(sk)->conn->hcon : NULL; iso_pi(sk)->qos.bcast.encryption =3D ev2->encryption; =20 if (ev2->num_bis < iso_pi(sk)->bc_num_bis) @@ -2409,9 +2409,11 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *= bdaddr, __u8 *flags) if (!sk) goto done; =20 - hcon =3D iso_pi(sk)->conn->hcon; + lock_sock(sk); + + hcon =3D iso_pi(sk)->conn ? iso_pi(sk)->conn->hcon : NULL; if (!hcon) - goto done; + goto release3; =20 if (ev3->data_status =3D=3D LE_PA_DATA_TRUNCATED) { /* The controller was unable to retrieve PA data. */ @@ -2419,12 +2421,12 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t = *bdaddr, __u8 *flags) HCI_MAX_PER_AD_TOT_LEN); hcon->le_per_adv_data_len =3D 0; hcon->le_per_adv_data_offset =3D 0; - goto done; + goto release3; } =20 if (hcon->le_per_adv_data_offset + ev3->length > HCI_MAX_PER_AD_TOT_LEN) - goto done; + goto release3; =20 memcpy(hcon->le_per_adv_data + hcon->le_per_adv_data_offset, ev3->data, ev3->length); @@ -2443,18 +2445,19 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t = *bdaddr, __u8 *flags) &base_len); =20 if (!base || base_len > BASE_MAX_LENGTH) - goto done; + goto release3; =20 - lock_sock(sk); memcpy(iso_pi(sk)->base, base, base_len); iso_pi(sk)->base_len =3D base_len; - release_sock(sk); } else { /* This is a PA data fragment. Keep pa_data_len set to 0 * until all data has been reassembled. */ hcon->le_per_adv_data_len =3D 0; } + +release3: + release_sock(sk); } else { sk =3D iso_get_sock(hdev, &hdev->bdaddr, BDADDR_ANY, BT_LISTEN, iso_match_dst, BDADDR_ANY); --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F88F382383; Fri, 24 Jul 2026 20:20:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924451; cv=pass; b=axw3NMngS6nGWYMpyROZSeVrj7zK6b2veX1VCl2x8gQmva47cO00qBEiZC8irYD6b6UiGo2AUzHqnpaljfYIJ9TFhRe2nkNYGOuBlkQ2eBVSFXSnRKjWqjiyAFsBWBaD0ltRF8m2qg3f5buBYRCRR5VQdBhSF2JYkiaD9usKM6o= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924451; c=relaxed/simple; bh=SHG/RO+SmJ77o4uRBtFwMTX1JEegiSW3yQvhyQiI7Ys=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ArR2Zeqw4wFY+Jkn/9cO4s1kJ3GFcxwgEBseTSELv8KfaM/bEHFKmEpxVW8XpPhT+zo5jntReiR7FpRS/gcQv/1UFjOYurqYflNARhRFfVOAOErbaYIH2R7z6QVu6qe4WeqfiCrry32X2PLHr2mM7lzoJfQG6PcJky0tE/k5la4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=uFJrCWnJ; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="uFJrCWnJ" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KB70m0gzybX; Fri, 24 Jul 2026 23:20:46 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924448; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/20aiEEiCKr0RFwSceTIF80aa4+pazXF3tL76TpT9ck=; b=uFJrCWnJSVZLq21Jn7RYUQgkVnY5+ppLHmlJ6whGgov3FAKxKt6FJJBk1db3Y3zRF2mS9a FS039oNLFXw/X3Z6jYxOp7vYoosBwEom4MRvwFjDwOq0qPjDwzJPhDAkrWngs6GqvntFwc MdUOgXRZcU68hwOZXMFuswTTC3N8Bp8= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924448; b=vTv8j5GCRHvZxHpTBBe3qlaR17y3eRC6mMsjeNvO+709daQXdeSpKtNcDsqUsZMwcvu1cN oQaVdI84wfsdpR2oOuICijIYiQ4do3e5IM9ozxsolUmzkC2XiTlAZNb5FX7UU1f5Pa9okI ZrcSc5dYT5Dw4u0W6xqaQ3X8x9fD9mk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924448; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/20aiEEiCKr0RFwSceTIF80aa4+pazXF3tL76TpT9ck=; b=uy8nTSDbtqgXPU3L4lRwRpVSEx4lcqe8yic8I8Th5JW623N/oA9EK7iapiU2TlczCtt5gR HlULrS1Ztv1hPqP5JlpTMp2nBpDFG32BgZ+lWzkTd/SdXycPvGHTgPdK90s6F7rw8bRMOp YbqBnrd37y1suhGGBYv6Eqa4dN9U/74= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 04/11] Bluetooth: ISO: fix timeout vs sync_timeout typo in check_bcast_qos Date: Fri, 24 Jul 2026 23:20:27 +0300 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In iso.c check_bcast_qos(), missing bcast.timeout is not set to its default value, and appears typoed as bcast.sync_timeout. Fix the typo. Fixes: b37cab587aa3 ("Bluetooth: ISO: Don't reject BT_ISO_QOS if parameters= are unset") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 651661833966..e51253e5c161 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1796,7 +1796,7 @@ static bool check_bcast_qos(struct bt_iso_qos *qos) return false; =20 if (!qos->bcast.timeout) - qos->bcast.sync_timeout =3D BT_ISO_SYNC_TIMEOUT; + qos->bcast.timeout =3D BT_ISO_SYNC_TIMEOUT; =20 if (qos->bcast.timeout < 0x000a || qos->bcast.timeout > 0x4000) return false; --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 749C23B27C1; Fri, 24 Jul 2026 20:20:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924453; cv=pass; b=kpMzOhZ1rcLAwBijMQ+zyvpzEPKKvQHhio+278zINX8RoNg24iqJuRluqBKqYEFdpjzwwtEUIZwzMKmjErdmtU1Mrz6FzJJgAGiegRURp788y1zelL6AgD/gGe2Y+c8+Hgv+xCg8gLWkXpMZ51XsO7hTBPDgrLusRF6+0j0VdGE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924453; c=relaxed/simple; bh=zBdnU5qqOpG2EAi0UHShZDaqXgYifMh/DS9uXCqR8RI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=geTeqehYz/KOibh0qiBkBDmCf4aXN5BNdnUTQGtGWUTFmpGXZtFdmd+U5CtVP+iiq8ujFPcH7LL2khomlhPzHxglnba3st8OfbIEz55FvWB2GriUo8y/tgE+yASxqxTt2mFD+IXujQj+SYjX0qatC67s+ufsjDfakFg6VRV4cDI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=BEZgnSEJ; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="BEZgnSEJ" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KB86SxWzybb; Fri, 24 Jul 2026 23:20:48 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924450; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9Q2K2lP9evOiz1Steo7+JHozlCGL/NBNyKabBb6lZCg=; b=BEZgnSEJUCIPvpG9qnIRt8qaisZzHCTOgh7pk4iqj88qtKWxe0/MG9s2aodqjJMlZq8pPY 6NIx5eK8OaanMvLdSpC+kUlVPDjwKRIdWzOJCqRDf+SMAWFuu+4YA8ta+QBfs+LOq968Eg xE0bQIcsBCGulvqBZry2CzUJWMVudMs= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924450; b=kiaBZKANL8Tbdt7AvYQiFhi09wDH+psJgEs3Fwc1D2lCmnKivX+puaRup9T8Hhd9AeOMMt nEd6DhyACaeFisStcyL1eWlh8wzC8cYnddLcQH0A44w/VLFZVyb69dRAhGcTw3B1qVucbl u8U7Pj0kE/wfVFpNPbNu0cHTtebrQWo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924450; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9Q2K2lP9evOiz1Steo7+JHozlCGL/NBNyKabBb6lZCg=; b=A9gsuSVO+qM0dfsaqnRYQE/jj7OVa/uhi1zzdo/ks1dt7P02/eSz4Ci0L4oawJKE3b87SC ZTgfLdvfJkMW4xZ3DfUqVMkUkOQ8nVAGSLSZVy6GFhQXWoCoWu7AtzzpKF5QrbmEZF95IR yDKiEwAQxUkY7vSIzXqnNclLi0Flk8w= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 05/11] Bluetooth: ISO: validate sockaddr_iso first in iso_sock_rebind_bis() Date: Fri, 24 Jul 2026 23:20:28 +0300 Message-ID: <7b2ce38199de98371bae313cc69dc25d7ab8768b.1784923689.git.pav@iki.fi> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iso_sock_rebind_bis() updates socket iso_pi(sk)->bc_num_bis before validating the BIS values, so it's possible to end up with bc_num_bis inconsistent. Assign to iso_pi(sk)->bc_num_bis only after validation. Fixes: 80837140c1f2 ("Bluetooth: ISO: Allow binding a PA sync socket") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index e51253e5c161..5de4a2f886eb 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1039,15 +1039,15 @@ static int iso_sock_rebind_bis(struct sock *sk, str= uct sockaddr_iso *sa, goto done; } =20 - iso_pi(sk)->bc_num_bis =3D sa->iso_bc->bc_num_bis; - - for (int i =3D 0; i < iso_pi(sk)->bc_num_bis; i++) + for (int i =3D 0; i < sa->iso_bc->bc_num_bis; i++) if (sa->iso_bc->bc_bis[i] < 0x01 || sa->iso_bc->bc_bis[i] > 0x1f) { err =3D -EINVAL; goto done; } =20 + iso_pi(sk)->bc_num_bis =3D sa->iso_bc->bc_num_bis; + memcpy(iso_pi(sk)->bc_bis, sa->iso_bc->bc_bis, iso_pi(sk)->bc_num_bis); =20 --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D2D253B2FC2; Fri, 24 Jul 2026 20:20:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924460; cv=pass; b=YtKG97UQhd8nmIz6e8pbHeHvse/kVdVQf5UOqcGakSFaiVq4I7TJIm09GrSzTfJRZtl0/czf2pexqNcATMQP/c5PMNTAzmNGjTvuP0rWkD7caGs046TgUGzVDwC4uAB5olveWuIMW6cPQW6ezyZVo1MRBNFB/hPNgLB6sA6/uGg= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924460; c=relaxed/simple; bh=IUfhJibQ8PWq8wEjiUFCy9u1EK09x/sH8c2uAMr8SDg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RoVJtcmm6PqE5Za4IZEAbhnVX5o27W1y+ebYVfpGwvohqws3q3iT9rpQxqWKux4vvmfOOO44AeS+kqj2KPXmZLRBwtX22G/eKFTdnd6zEeHglGObaOhwMh3aHNhpx+0Ku5san+apS/uRr92ny2vJiUib6oOjA8NpLsgXgbe9vyA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=AjgA1zzh; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="AjgA1zzh" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KBB5V61zyc2; Fri, 24 Jul 2026 23:20:50 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924452; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Yg6adg4D1+AWwokr1LUf/baS+b9XSlEzwrPbVKcgDns=; b=AjgA1zzhPuA4M03XL76MoFJQ044LJzL+KKwE4kXUzFERh31ox9mmSUP9szJaP4VVcD0iez tPHeIYrk+EHJIyRie4DuExZAyiKANXo/lIIt4iYaqqdbPwMzjPdDmoPKHI/icR9VWdgVee tb7sqikeLjtiRq6ePTSw7iq50cnPrnQ= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924452; b=queE09pQMIRIR6ubPwx/0SBh/jqWq3yfxIXoJ6xqvI+KWGgnkZ32TsvDsLTBgYBoggBpbq AT4AJfkX61ZC3KQeNaLTJOUo17hVs28aFVSpMbatNEiYkbok5x+ab339011IGj3GwfYIYE xI6K1tN9fFi6CcnJxqCGBkrTihWbQB0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924452; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Yg6adg4D1+AWwokr1LUf/baS+b9XSlEzwrPbVKcgDns=; b=SnPf+lxIpraiJZhBrHdG7QYgAssONmH08EbOvcZJuAAzgPpMiRNz/yUn3aXUWWz4vlUFPY YAnOZnj3aq1Hy71YK1laExAw8tizFPyCgERtfmtQRf7XS+F3sxnwK5SrJbAFi18EAah5QJ bpck5pAoBcIA86Hm9HbRzyw5/Dl05P8= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 06/11] Bluetooth: ISO: hold sk properly in iso_conn_ready Date: Fri, 24 Jul 2026 23:20:29 +0300 Message-ID: <6ce88b5e06ebc89e5e848ea3deb150e03805f2fd.1784923689.git.pav@iki.fi> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk =3D conn->sk lock_sock(sk) conn->sk =3D NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 5de4a2f886eb..80a58275891d 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -805,11 +805,13 @@ static void iso_sock_kill(struct sock *sk) BT_DBG("sk %p state %d", sk, sk->sk_state); =20 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ + lock_sock(sk); if (iso_pi(sk)->conn) { iso_conn_lock(iso_pi(sk)->conn); iso_pi(sk)->conn->sk =3D NULL; iso_conn_unlock(iso_pi(sk)->conn); } + release_sock(sk); =20 /* Kill poor orphan */ bt_sock_unlink(&iso_sk_list, sk); @@ -2047,23 +2049,17 @@ static void iso_sock_ready(struct sock *sk) { BT_DBG("sk %p", sk); =20 - if (!sk) - return; - - lock_sock(sk); + lockdep_assert(lockdep_sock_is_held(sk)); =20 switch (sk->sk_state) { case BT_DISCONN: case BT_CLOSED: - release_sock(sk); return; } =20 iso_sock_clear_timer(sk); sk->sk_state =3D BT_CONNECTED; sk->sk_state_change(sk); - - release_sock(sk); } =20 static bool iso_match_big(struct sock *sk, void *data) @@ -2093,7 +2089,7 @@ static bool iso_match_dst(struct sock *sk, void *data) static void iso_conn_ready(struct iso_conn *conn) { struct sock *parent =3D NULL; - struct sock *sk =3D conn->sk; + struct sock *sk; struct hci_ev_le_big_sync_established *ev =3D NULL; struct hci_ev_le_pa_sync_established *ev2 =3D NULL; struct hci_ev_le_per_adv_report *ev3 =3D NULL; @@ -2102,7 +2098,22 @@ static void iso_conn_ready(struct iso_conn *conn) =20 BT_DBG("conn %p", conn); =20 + iso_conn_lock(conn); + sk =3D iso_sock_hold(conn); + iso_conn_unlock(conn); + if (sk) { + lock_sock(sk); + + /* conn->sk may have become NULL if racing with sk close, but + * due to held hdev->lock, it can't become different sk. + */ + if (!conn->sk) { + release_sock(sk); + sock_put(sk); + return; + } + /* Attempt to update source address in case of BIS Sender if * the advertisement is using a random address. */ @@ -2115,14 +2126,15 @@ static void iso_conn_ready(struct iso_conn *conn) adv =3D hci_find_adv_instance(bis->hdev, bis->iso_qos.bcast.bis); if (adv && bacmp(&adv->random_addr, BDADDR_ANY)) { - lock_sock(sk); iso_pi(sk)->src_type =3D BDADDR_LE_RANDOM; bacpy(&iso_pi(sk)->src, &adv->random_addr); - release_sock(sk); } } =20 - iso_sock_ready(conn->sk); + iso_sock_ready(sk); + + release_sock(sk); + sock_put(sk); } else { hcon =3D conn->hcon; if (!hcon) --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50BAFDF59; Fri, 24 Jul 2026 20:20:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924462; cv=pass; b=pvsBgzZQjhYys/DWR24cqawXIfVJORjfwvCYl4/o8LSV6tIXmKDljUsNxiD0QYYcma1DxRtQQgZFBz1zITqX/084uSbpYoIoOh502g+7SbrhKq6B8jdre3ilVSOAX0DasxB7n0NB6s2+suFNlyOgBg5t9WsxCR9E/1AuEr55pRk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924462; c=relaxed/simple; bh=r1mrQYEbSXOMLLJrXhEjlo+6dNsR+rQfl8Fo8+tRcbE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Qfki2q4wlAC/AgfcA5d9PwBtF92c+6rzwYv7MGmgElq/G7Nsl7pZB1a37rkmf+lzRalOK8pHnYezCS1YJqHUhjm6c7BMZGAkPtUKRePV3kMH8OCFqBIOeU82pMPs4iYRyB3N6HenBqBVxV5t4UIX255aNs3e+EywPBOI9Fmy3Hk= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=EkmrIE4Z; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="EkmrIE4Z" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KBD4PqgzyQq; Fri, 24 Jul 2026 23:20:52 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924453; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=blpzDVZeHkyB9hZ00OWamntBW35ZDd0tWBbUkewuOfA=; b=EkmrIE4Z73O9UrxDIcWnP/AEBlm7VCXPcixhYJCSjEwTtCjp0BilxyqJQ/NQ1MKwQDOJtR kXM0h2hbYZlHnnkzkq0wnLwmVqGaNUynyF5utTh/gvQAN0z0lqiMCDQnENB55oKrgwMgFW J9cX+oNaQdhQXl/UFPW3WrdGBuNCfMQ= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924453; b=bwNu9+sIPmRHLluJwDecwkmdT7m4cddXen05MyUv47lghpHWgTKSkx0PmmdHyEufiUut+V IaDq0PMas9Aqsk0+pNi0ceQ+5A3puj4Fyn0ZHTQcHW5C9W/vQsGE6cF2vaSC75H5GYU/A9 Ni3SrzEvwrFwUAxY7di8hF96T/gfiEk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924453; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=blpzDVZeHkyB9hZ00OWamntBW35ZDd0tWBbUkewuOfA=; b=a5QFZAkrw9mrd4tSEBAmBUhVtFZElela4xx1VAmgaRCv3Qcy75SPN+/CgjHY4u/Q/4LtKZ /iIWFUt40fA+EVb1E/0ooDoq+kT/yd/rzroPwOp4J2sWJQr92D/y/sfTHWfzGJl+M7ozb2 7JWJ3o4AGqTHW8oW4vUqLT3cwepgoI0= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 07/11] Bluetooth: ISO: fix leaking sk after socket release Date: Fri, 24 Jul 2026 23:20:30 +0300 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iso_sock_kill() tests !sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || sock_flag(sk, SOCK_DEAD) for early return, but this is always true since sock_orphan(sk) sets SOCK_DEAD, so the sk reference released by socket always leaks, iso_sock_destruct is never called. The socket reference also leaks when __iso_sock_close() does not set SOCK_ZAPPED, since iso_conn_del() does not call iso_sock_kill() after zapping. Fix by replacing SOCK_DEAD by BT_SK_KILLED flag that is not used for something else, and lock_sock to ensure iso_sock_kill() puts sk only after socket release only once. Release and iso_conn_del may run concurrently. Call iso_sock_kill() from iso_conn_del() to clean sk up after zapping. Remove call to iso_sock_kill() from iso_sock_close(), as it's generally no-op there. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 80a58275891d..5f0f45a573a7 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -62,6 +62,7 @@ static void iso_sock_kill(struct sock *sk); enum { BT_SK_BIG_SYNC, BT_SK_PA_SYNC, + BT_SK_KILLED, }; =20 struct iso_pinfo { @@ -295,6 +296,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err) iso_sock_clear_timer(sk); iso_chan_del(sk, err); release_sock(sk); + iso_sock_kill(sk); sock_put(sk); } =20 @@ -798,24 +800,29 @@ static void iso_sock_cleanup_listen(struct sock *pare= nt) */ static void iso_sock_kill(struct sock *sk) { + lock_sock(sk); + if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || - sock_flag(sk, SOCK_DEAD)) + test_bit(BT_SK_KILLED, &iso_pi(sk)->flags)) { + release_sock(sk); return; + } =20 BT_DBG("sk %p state %d", sk, sk->sk_state); =20 /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ - lock_sock(sk); if (iso_pi(sk)->conn) { iso_conn_lock(iso_pi(sk)->conn); iso_pi(sk)->conn->sk =3D NULL; iso_conn_unlock(iso_pi(sk)->conn); } - release_sock(sk); =20 /* Kill poor orphan */ bt_sock_unlink(&iso_sk_list, sk); sock_set_flag(sk, SOCK_DEAD); + set_bit(BT_SK_KILLED, &iso_pi(sk)->flags); + + release_sock(sk); sock_put(sk); } =20 @@ -892,7 +899,6 @@ static void iso_sock_close(struct sock *sk) iso_sock_clear_timer(sk); __iso_sock_close(sk); release_sock(sk); - iso_sock_kill(sk); } =20 static void iso_sock_init(struct sock *sk, struct sock *parent) @@ -2040,8 +2046,16 @@ static int iso_sock_release(struct socket *sock) release_sock(sk); } =20 + /* Make sure sk is valid even if iso_conn_del() is concurrent */ + sock_hold(sk); + + lock_sock(sk); sock_orphan(sk); + release_sock(sk); + iso_sock_kill(sk); + + sock_put(sk); return err; } =20 --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5104F34A79D; Fri, 24 Jul 2026 20:20:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924462; cv=pass; b=T9ZN2GjY0OtIw1Ahs4eBriJmwq+U43X2sZlDNgiFexsYku3xpFIrEbo0pH+D7DT5S3JySjzwKpE5EcqaEz3sFi31r0fIEPD7fybEUqHV1JtrmyljY1UcTARzbI7/nNzmG06NdKoNo0ZheEDGCMfEjT45PdQ5zj4cVI1k7pYBOWc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924462; c=relaxed/simple; bh=KGw37HWimL8GUMlYoC9NuI8Ufw9+0fiDugoW2aTDOoQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XkXTSNQGcLh6hB5YqIWuJD3zT3YDfVyFuT9JmTBXhnh6Ue3ybwWsN4baoPMUywc5AgWXYo+JRoNBObfFFTxeXe0KaPgIVuB0sqgkQ4kh/tGkyjJOXqi9MeLMxJ1bxZXKeWW6itatgBDrzwot2UhfoLxXffkihsnlDeFquBy6dUE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=l+cxu3Ry; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="l+cxu3Ry" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KBG1mPJzyVm; Fri, 24 Jul 2026 23:20:54 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IlKQ1ZC+1xVz0L955RIT5f4Q8s4F3vKgafHXx6cqrzQ=; b=l+cxu3Ry5o3mWEmGnKSIq3eMfE4J3KdCUOnBJj9h1lHgNrQTHr48ulYxx4a/KHgpL3XO3n GpEQNFQMY3rSYjQZMt5LWoFYIU6lZMtUTVfSxhg6p4Sqn/0oxblwNp1hekzT0UEl8rDdl5 iORm6J4kuBNEUiHvpL7ti0JIG8S4lAM= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924455; b=XLV+2zMkR1ZCWAunLM7euQlgTcpHNjYjpwm85Yi4HPo+EqTFFn0qjtB9IMWxkGoZNxUVzx aDrw8sceupTrM404/yfgYX6jn82EL9XyzS+IW7VnDBG1isr5lqYA2jQoPqTworDvPu9Xf6 5PShS9ULu+JJQH6LaSMfmYe3q+xaN6k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924455; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=IlKQ1ZC+1xVz0L955RIT5f4Q8s4F3vKgafHXx6cqrzQ=; b=Hgjwsq6mACrRfmppmSG2ejTGWEPXqhcXUQOkjA6huQa15hprzrWIeSd+0qwFzKmF9XmljP rCcdlkisReYG7onCXN6urmlBB4/HAUA1pvUULV5U0pCZBI1I/zlL2Z1e94YBHTkb5BNI0C ricqKMELAJ6OxQINQ8IEIpAq+CVtvAw= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 08/11] Bluetooth: ISO: avoid deadlocks in iso_sock_timeout Date: Fri, 24 Jul 2026 23:20:31 +0300 Message-ID: <47bac9e8d5b1bd7335a93ae5b834ac7065820b7c.1784923689.git.pav@iki.fi> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" iso_sock_timeout() takes lock_sock, so sync disabling the timer while holding that lock may deadlock. iso_sock_timeout() may also run concurrently with iso_conn_del(), which leads to UAF [Task 1] [Task hdev->workqueue] iso_sock_timeout iso_conn_del iso_conn_hold_unless_zero iso_chan_del `------------> iso_conn_put caller frees hcon iso_conn_put iso_conn_free conn->hcon->iso_data =3D NULL; /* UAF */ Fix the deadlock by removing the disable from the lock_sock sections. Move the timer from iso_conn to iso_pinfo to decouple it from iso_conn which may need to be freed in lock_sock section. Convert some of the clear_timer to disable_timer. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_con= n") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 60 ++++++++++++++++++++++----------------------- 1 file changed, 29 insertions(+), 31 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 5f0f45a573a7..0cc08416fde5 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -37,8 +37,6 @@ struct iso_conn { spinlock_t lock; struct sock *sk; =20 - struct delayed_work timeout_work; - struct sk_buff *rx_skb; __u32 rx_len; __u16 tx_sn; @@ -81,6 +79,7 @@ struct iso_pinfo { __u8 base_len; __u8 base[BASE_MAX_LENGTH]; struct iso_conn *conn; + struct delayed_work timeout_work; }; =20 static struct bt_iso_qos default_qos; @@ -118,9 +117,6 @@ static void iso_conn_free(struct kref *ref) hci_conn_drop(conn->hcon); } =20 - /* Ensure no more work items will run since hci_conn has been dropped */ - disable_delayed_work_sync(&conn->timeout_work); - kfree_skb(conn->rx_skb); =20 kfree(conn); @@ -161,48 +157,45 @@ static struct sock *iso_sock_hold(struct iso_conn *co= nn) =20 static void iso_sock_timeout(struct work_struct *work) { - struct iso_conn *conn =3D container_of(work, struct iso_conn, - timeout_work.work); - struct sock *sk; - - conn =3D iso_conn_hold_unless_zero(conn); - if (!conn) - return; - - iso_conn_lock(conn); - sk =3D iso_sock_hold(conn); - iso_conn_unlock(conn); - iso_conn_put(conn); - - if (!sk) - return; + struct iso_pinfo *pi =3D container_of(work, struct iso_pinfo, + timeout_work.work); + struct sock *sk =3D &pi->bt.sk; =20 BT_DBG("sock %p state %d", sk, sk->sk_state); =20 lock_sock(sk); - sk->sk_err =3D ETIMEDOUT; - sk->sk_state_change(sk); + if (!sock_flag(sk, SOCK_ZAPPED)) { + sk->sk_err =3D ETIMEDOUT; + sk->sk_state_change(sk); + } release_sock(sk); - sock_put(sk); } =20 static void iso_sock_set_timer(struct sock *sk, long timeout) { + lockdep_assert(lockdep_sock_is_held(sk)); + + cancel_delayed_work(&iso_pi(sk)->timeout_work); + if (!iso_pi(sk)->conn) return; =20 BT_DBG("sock %p state %d timeout %ld", sk, sk->sk_state, timeout); - cancel_delayed_work(&iso_pi(sk)->conn->timeout_work); - schedule_delayed_work(&iso_pi(sk)->conn->timeout_work, timeout); + schedule_delayed_work(&iso_pi(sk)->timeout_work, timeout); } =20 static void iso_sock_clear_timer(struct sock *sk) { - if (!iso_pi(sk)->conn) - return; + BT_DBG("sock %p state %d", sk, sk->sk_state); + cancel_delayed_work(&iso_pi(sk)->timeout_work); +} + +static void iso_sock_disable_timer(struct sock *sk) +{ + lockdep_assert(!lockdep_sock_is_held(sk)); =20 BT_DBG("sock %p state %d", sk, sk->sk_state); - cancel_delayed_work(&iso_pi(sk)->conn->timeout_work); + disable_delayed_work_sync(&iso_pi(sk)->timeout_work); } =20 /* ---- ISO connections ---- */ @@ -227,7 +220,6 @@ static struct iso_conn *iso_conn_add(struct hci_conn *h= con) =20 kref_init(&conn->ref); spin_lock_init(&conn->lock); - INIT_DELAYED_WORK(&conn->timeout_work, iso_sock_timeout); =20 hcon->iso_data =3D conn; conn->hcon =3D hcon; @@ -292,8 +284,9 @@ static void iso_conn_del(struct hci_conn *hcon, int err) return; } =20 + iso_sock_disable_timer(sk); + lock_sock(sk); - iso_sock_clear_timer(sk); iso_chan_del(sk, err); release_sock(sk); iso_sock_kill(sk); @@ -800,6 +793,8 @@ static void iso_sock_cleanup_listen(struct sock *parent) */ static void iso_sock_kill(struct sock *sk) { + iso_sock_disable_timer(sk); + lock_sock(sk); =20 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || @@ -895,8 +890,9 @@ static void __iso_sock_close(struct sock *sk) /* Must be called on unlocked socket. */ static void iso_sock_close(struct sock *sk) { + iso_sock_disable_timer(sk); + lock_sock(sk); - iso_sock_clear_timer(sk); __iso_sock_close(sk); release_sock(sk); } @@ -965,6 +961,8 @@ static struct sock *iso_sock_alloc(struct net *net, str= uct socket *sock, iso_pi(sk)->qos =3D default_qos; iso_pi(sk)->sync_handle =3D -1; =20 + INIT_DELAYED_WORK(&iso_pi(sk)->timeout_work, iso_sock_timeout); + bt_sock_link(&iso_sk_list, sk); return sk; } --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6160E3B27D6; Fri, 24 Jul 2026 20:20:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924465; cv=pass; b=LvZSb7vDZ2gy0Y377L2eRBcwxaOjCUdp5BOruu8DyjJ9iQLmddqJTeHLvtJsxOAOisv895Ak1B4a0X9kovXllHWDqQQf986RYXOdmtGytlP5mKVFXrU3w95UvWGba7XwNkn2UqUoeYLjIlGc4HJRXunfQWQZJOhpwG7nnQfjmjw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924465; c=relaxed/simple; bh=cXFf7YSd9JW72pVooGerQAnmqjnetHHiPX/3quozHak=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pOZufx1VYUkhUMhbhGtAvTpzHfuNkydFnX1PAhlZvRVV67PiL8YJyRF86jv8oNacReXazPxtkEo05pNRKaryLc8F9n2Vlxi4qH9/J7XMKaWN60/0njXy8mOl6wwFI2mnhoB0Vy0hgU2FcKjeWQEeKIpt3qONz51gkX61OpurqDU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=lAhF92i3; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="lAhF92i3" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KBJ07jvzyWH; Fri, 24 Jul 2026 23:20:55 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924457; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=H0fjg7kB4MMr+2W5AxUyDH8m0z85mGqM1zn5UvrZksY=; b=lAhF92i3Bu7wQ0MNBNTRifGvHMux8EHjwaaHh7McQ2qBLeWwXAhT5FmdolfNWAkMaN2ziY 96vPXnUf1AxRvxwOvVLc13NUwcqjq9uac43IX/g5oYZxbws2Tun6+qVqDSWZ2iROFROKFf blaQcrJKxEbekUlbo8HzG52vv1IT9j4= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924457; b=I7oXr7VktZ6RQibib52VUSyCUKsqt29AM406Ky1tZFkSwjAiiuWXK5F64q2AJFHrr5GQWC qLW4Wx5uOShJI+L75+JPPvppJn3kekO1xiHIkZ7xMeZAIP1M1zFs6VZ1EaYQpN64PNMcUU Qejzm/IPJKwJ9rCwAYF4Ow1HwD79m9Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924457; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=H0fjg7kB4MMr+2W5AxUyDH8m0z85mGqM1zn5UvrZksY=; b=h0BYi//uCIb6xVsPwnIwXyA32Z9r6kQCn/LgbnhITrm0rz6/xGTeozScaHC4qfUIIuzFIc MPu4EtR0d0Nwi2sh7pZ1Gf7NwFJb5flxYB04mKZjPaNaaainKwrexsj4YwyhrotYI6dN0l /V/ZubWZF/uDBdiiZD7hLyFlK0woK1Q= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 09/11] Bluetooth: ISO: ensure no dangling hcon references in iso_conn Date: Fri, 24 Jul 2026 23:20:32 +0300 Message-ID: <589d71aa2a77385c608e0445bd684897831be40f.1784923689.git.pav@iki.fi> X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn. Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to avoid more complex reasoning on races about who holds the last reference. Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 0cc08416fde5..bfd39baa8503 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -263,6 +263,7 @@ static void iso_chan_del(struct sock *sk, int err) } =20 static void iso_conn_del(struct hci_conn *hcon, int err) + __must_hold(&hcon->hdev->lock) { struct iso_conn *conn =3D hcon->iso_data; struct sock *sk; @@ -277,11 +278,10 @@ static void iso_conn_del(struct hci_conn *hcon, int e= rr) iso_conn_lock(conn); sk =3D iso_sock_hold(conn); iso_conn_unlock(conn); - iso_conn_put(conn); =20 if (!sk) { iso_conn_put(conn); - return; + goto done; } =20 iso_sock_disable_timer(sk); @@ -291,6 +291,15 @@ static void iso_conn_del(struct hci_conn *hcon, int er= r) release_sock(sk); iso_sock_kill(sk); sock_put(sk); + +done: + /* No sk access to conn->hcon any more (lock_sock + hdev->lock) */ + iso_conn_lock(conn); + conn->hcon =3D NULL; + hcon->iso_data =3D NULL; + iso_conn_unlock(conn); + + iso_conn_put(conn); } =20 static int __iso_chan_add(struct iso_conn *conn, struct sock *sk, @@ -306,6 +315,11 @@ static int __iso_chan_add(struct iso_conn *conn, struc= t sock *sk, return -EBUSY; } =20 + if (!conn->hcon) { + BT_ERR("conn->hcon missing"); + return -EIO; + } + iso_pi(sk)->conn =3D conn; conn->sk =3D sk; clear_bit(ISO_CONN_DROPPED, conn->flags); @@ -2500,6 +2514,7 @@ int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *b= daddr, __u8 *flags) } =20 static void iso_connect_cfm(struct hci_conn *hcon, __u8 status) + __must_hold(&hcon->hdev->lock) { if (hcon->type !=3D CIS_LINK && hcon->type !=3D BIS_LINK && hcon->type !=3D PA_LINK) { @@ -2511,8 +2526,10 @@ static void iso_connect_cfm(struct hci_conn *hcon, _= _u8 status) struct hci_link *link, *t; =20 list_for_each_entry_safe(link, t, &hcon->link_list, - list) + list) { + lockdep_assert_held(&link->conn->hdev->lock); iso_conn_del(link->conn, bt_to_errno(status)); + } =20 return; } @@ -2542,6 +2559,7 @@ static void iso_connect_cfm(struct hci_conn *hcon, __= u8 status) } =20 static void iso_disconn_cfm(struct hci_conn *hcon, __u8 reason) + __must_hold(&hcon->hdev->lock) { if (hcon->type !=3D CIS_LINK && hcon->type !=3D BIS_LINK && hcon->type !=3D PA_LINK) --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8DBC3ADB97; Fri, 24 Jul 2026 20:22:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924528; cv=pass; b=U0W9u8zcF6o7+twTE/ERvxv8QTmsqF+rVpzp6u9gNlirdLGmLcjkH+f1iCNtotoWRnvo0uf2aC4Ykp40k6F7FMMUKEh+CPn8mJUaO8ecBz3O7L1BDxRsUhcKXI+Vrn/XGs/S1GohII33edfwquvSVpVJqDBIH64A1lbu7fdL7xU= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924528; c=relaxed/simple; bh=n/+mhAVUxazbWJa6Bud9xSojL6eW7r1MVvaLMyusoXo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=rR9SVqSYH2BYPbIEvLAzDkRCmS+4d7/C1mZVGVL9ggwdB4xGRQnq55xwxzTW5OAxwEb/b/MHyuFH1zavYqb9YUCUEUEEW/ixgwpcg21YhSD/FMIDfYwtpCbjF7T/0qiyi9cuBLw2RMY4W/VNWJ28eHvut806lQjRq2FA3XDR2pg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=Lw0rC9iw; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="Lw0rC9iw" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KCZ4VM6zyPm; Fri, 24 Jul 2026 23:22:02 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924524; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+VDcVRE0XFMxw0TsZdeSr2A6qJbaBYCqcIPzVhQA98U=; b=Lw0rC9iwdvdvtYRWn5fS2PzbbUDZva7tfC4ogJYzGVsNZ5PL7wzYi8ae4bh5eLRLRLQsUB +8I0rivsHk68F5SM9R2fYUnPNO0qj27M1Cqkg4zfm73fzBtCcONkXr+l75EappEtsfctyg D+7PzgPyYhCAEItWuDJLfDr6YSGq+Ow= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924524; b=Le85S1U/JM3a1lawV+InZFpFN9eH0j26anhNCBo4enp3bkrWUs1U7xqkVLVSMTnZAlEu/n U7AeNI8vZ/cz2mnj/BV+qo3PKgKK+py9z3ONrmjXe0DeAGe2kBVqS7A3tS30n2bsw6LW7v Ya+H5WVwlEFQeSJSvjkPaWtzL6bc5/A= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924524; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+VDcVRE0XFMxw0TsZdeSr2A6qJbaBYCqcIPzVhQA98U=; b=rmCbBI5IbGnLe6EyrT03KbyxJJxE55+vDHLMaPv3Qg8UjW+uoixTFfaIQ6c3fAnsTI57XJ zliNbpynDVP5yY4xXaJSDN/nRWe/Xf2A8DiGk2hx9wqmTj5CloxKHatG77VuCqUrTQg0eB h5HihkQbF7gh1yAl7KE1F2izOHun8uc= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 10/11] Bluetooth: ISO: fix refcounting of iso_conn Date: Fri, 24 Jul 2026 23:20:33 +0300 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn: [Task hdev->workqueue] [Task 2] iso_conn_del iso_chan_del iso_conn_hold_unless_zero iso_conn_lock iso_conn_lock conn->sk =3D NULL iso_conn_unlock sk =3D iso_sock_hold(conn) <---------=C2=B4 if (!sk) iso_conn_put iso_conn_put iso_conn_put /* UAF */ The extra put for !sk in iso_conn_del() is currently required since failing iso_chan_add() may leave iso_conn not associated with any sk. Fix by having iso_pi(sk)->conn own refcount when non-NULL, so iso_conn_del does not need to put it. Adjust the iso_conn_add() refcounting so that conn is put if it does not get associated with an sk. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_con= n") Signed-off-by: Pauli Virtanen --- net/bluetooth/iso.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index bfd39baa8503..30de99ba4b30 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -108,9 +108,6 @@ static void iso_conn_free(struct kref *ref) =20 BT_DBG("conn %p", conn); =20 - if (conn->sk) - iso_pi(conn->sk)->conn =3D NULL; - if (conn->hcon) { conn->hcon->iso_data =3D NULL; if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) @@ -145,6 +142,14 @@ static struct iso_conn *iso_conn_hold_unless_zero(stru= ct iso_conn *conn) return conn; } =20 +static struct iso_conn *iso_conn_hold(struct iso_conn *conn) +{ + BT_DBG("conn %p refcnt %u", conn, kref_read(&conn->ref)); + + kref_get(&conn->ref); + return conn; +} + static struct sock *iso_sock_hold(struct iso_conn *conn) { if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk)) @@ -210,7 +215,6 @@ static struct iso_conn *iso_conn_add(struct hci_conn *h= con) conn->hcon =3D hcon; iso_conn_unlock(conn); } - iso_conn_put(conn); return conn; } =20 @@ -279,10 +283,8 @@ static void iso_conn_del(struct hci_conn *hcon, int er= r) sk =3D iso_sock_hold(conn); iso_conn_unlock(conn); =20 - if (!sk) { - iso_conn_put(conn); + if (!sk) goto done; - } =20 iso_sock_disable_timer(sk); =20 @@ -320,7 +322,7 @@ static int __iso_chan_add(struct iso_conn *conn, struct= sock *sk, return -EIO; } =20 - iso_pi(sk)->conn =3D conn; + iso_pi(sk)->conn =3D iso_conn_hold(conn); conn->sk =3D sk; clear_bit(ISO_CONN_DROPPED, conn->flags); =20 @@ -427,6 +429,7 @@ static int iso_connect_bis(struct sock *sk) } =20 err =3D iso_chan_add(conn, sk, NULL); + iso_conn_put(conn); if (err) goto unlock; =20 @@ -529,6 +532,7 @@ static int iso_connect_cis(struct sock *sk) } =20 err =3D iso_chan_add(conn, sk, NULL); + iso_conn_put(conn); if (err) goto unlock; =20 @@ -1310,10 +1314,9 @@ static int iso_listen_bis(struct sock *sk) } =20 err =3D iso_chan_add(conn, sk, NULL); - if (err) { - hci_conn_drop(hcon); + iso_conn_put(conn); + if (err) goto unlock; - } =20 unlock: release_sock(sk); @@ -2551,8 +2554,10 @@ static void iso_connect_cfm(struct hci_conn *hcon, _= _u8 status) struct iso_conn *conn; =20 conn =3D iso_conn_add(hcon); - if (conn) + if (conn) { iso_conn_ready(conn); + iso_conn_put(conn); + } } else { iso_conn_del(hcon, bt_to_errno(status)); } --=20 2.55.0 From nobody Sat Jul 25 05:59:36 2026 Received: from meesny.iki.fi (meesny.iki.fi [195.140.195.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6BF813A1E67; Fri, 24 Jul 2026 20:22:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=195.140.195.201 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924530; cv=pass; b=lDCpWOd/5JG0AGcFXNim1AOoKTxn5XZ1tokONeGGdj2vGfEtQrFtd/oZUlTECXI9CT32bEXzUpuwfh7H1VVaxxzr4AgLxKGcaf8jmbqd87PwuNxpjctfwTGIdxMtVGsMTYV67VyMy2baOHR6lWPmT9PTUU6pOHW8v7HOYfsBO9o= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784924530; c=relaxed/simple; bh=tcMBm2dVOcDlfzrNh0HhverVF3HbHIOncLJSsVeRL2U=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mcPOed/49SbuSsjdffsf0R6vIx6WJ1Ngqri70aBMIBs9l1xl4ggD6v16l53g5OXplOCtQwIDtH/vZPyEKrQrAffEBMVFyY9xcstW0lUfrCdI1XpP00l1vMZ/Arl0BkfQzsTDTeDTuSeFuPn3BISG6nLLx+NFiy1ni4lyCyTm2Wo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi; spf=pass smtp.mailfrom=iki.fi; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b=U6CSNPQy; arc=pass smtp.client-ip=195.140.195.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iki.fi Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iki.fi Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=iki.fi header.i=@iki.fi header.b="U6CSNPQy" Received: from monolith.lan (unknown [89.37.63.136]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: pav) by meesny.iki.fi (Postfix) with ESMTPSA id 4h6KCd2DLmzyVm; Fri, 24 Jul 2026 23:22:05 +0300 (EEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924526; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6NcDNrmp9hpCK1prRMPvKQzVwRCfKNPIjYJwflZJUUs=; b=U6CSNPQy0CFQVatJE+rRzPpPKkjYqKG/qjcgDsckKgsDitffgcaU292NutyxDw3YzenQ9d DkIOmwiOAWxUVPt52gfVwKR3MuHD1fImf4PnYB3s5RK955FY6r1X/+XMWlvXnzhBC2LKjZ 8tSedA7eJKYrJGBVc3k+7A3TEC3C8jE= ARC-Seal: i=1; a=rsa-sha256; d=iki.fi; s=meesny; cv=none; t=1784924526; b=k0jf+7NkgZu0Lzd7NrLD/3NygnZyssrsfbInbnPtZfcOif8nFaor4addTwAXExDFT7owME DbAyvwBoZeo1vFno65PfJ4OIuk3le0z7jhntDMn1jMSGoMOnLgYfzVyVI8vwGd6NHckJZd Miaurs9mbLZ1/o6XFglA44RtuE0pFsE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=iki.fi; s=meesny; t=1784924526; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=6NcDNrmp9hpCK1prRMPvKQzVwRCfKNPIjYJwflZJUUs=; b=uvA5zAYzXaxNoGI8MfGkV5McasevNHS3BSAZakcUVmNGt+yJn/6ono+dJ/vQpNTXb/DnWx 10dja/8D57xkKtZvcaxfq4xsDlo9gtmfnY8pSTQLl90C6kEi4szADaTb+p/Llq9aX0fIcA i3FO4gSaG4CpUWhCXEcJN5dnRUXszOY= ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=pav smtp.mailfrom=pav@iki.fi From: Pauli Virtanen To: linux-bluetooth@vger.kernel.org Cc: Pauli Virtanen , marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH 11/11] Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero Date: Fri, 24 Jul 2026 23:20:34 +0300 Message-ID: X-Mailer: git-send-email 2.55.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn =3D LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data =3D NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_con= n") Signed-off-by: Pauli Virtanen --- include/net/bluetooth/hci_core.h | 4 +- net/bluetooth/hci_conn.c | 2 + net/bluetooth/iso.c | 64 ++++++++++++++++++++++++++------ 3 files changed, 58 insertions(+), 12 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_c= ore.h index e7133ff87fbf..3df59849dcbe 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -767,9 +767,11 @@ struct hci_conn { struct dentry *debugfs; =20 struct hci_dev *hdev; + + spinlock_t proto_lock; /* lock guarding protocol data */ void *l2cap_data; void *sco_data; - void *iso_data; + void *iso_data __guarded_by(&proto_lock); =20 struct list_head link_list; struct hci_conn *parent; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 1966cd153d97..ebb04badf10c 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -1123,6 +1123,8 @@ static struct hci_conn *__hci_conn_add(struct hci_dev= *hdev, int type, INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); =20 + spin_lock_init(&conn->proto_lock); + atomic_set(&conn->refcnt, 0); =20 hci_dev_hold(hdev); diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 30de99ba4b30..a461c8a4efed 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -109,9 +109,16 @@ static void iso_conn_free(struct kref *ref) BT_DBG("conn %p", conn); =20 if (conn->hcon) { - conn->hcon->iso_data =3D NULL; - if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) - hci_conn_drop(conn->hcon); + spin_lock(&conn->hcon->proto_lock); + + /* Check we are not racing with iso_conn_add */ + if (conn->hcon->iso_data =3D=3D conn) { + conn->hcon->iso_data =3D NULL; + if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) + hci_conn_drop(conn->hcon); + } + + spin_unlock(&conn->hcon->proto_lock); } =20 kfree_skb(conn->rx_skb); @@ -126,7 +133,21 @@ static void iso_conn_put(struct iso_conn *conn) =20 BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); =20 + /* The following race vs. iso_conn_del() is possible: + * + * 1. conn->hcon !=3D NULL here + * 2. kref_put puts the last reference + * 3. concurrent iso_conn_del() gets iso_conn_hold_unless_zero() -> NULL + * and returns immediately, so conn->hcon is not cleared + * 4. iso_conn_free() dereferences conn->hcon + * + * To avoid UAF in step 4, take RCU before decrementing the refcount. + */ + rcu_read_lock(); + kref_put(&conn->ref, iso_conn_free); + + rcu_read_unlock(); } =20 static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn) @@ -205,22 +226,28 @@ static void iso_sock_disable_timer(struct sock *sk) =20 /* ---- ISO connections ---- */ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) + __must_hold(&hcon->hdev->lock) { - struct iso_conn *conn =3D hcon->iso_data; + struct iso_conn *conn; =20 - conn =3D iso_conn_hold_unless_zero(conn); + spin_lock(&hcon->proto_lock); + + conn =3D iso_conn_hold_unless_zero(hcon->iso_data); if (conn) { if (!conn->hcon) { iso_conn_lock(conn); conn->hcon =3D hcon; iso_conn_unlock(conn); } + spin_unlock(&hcon->proto_lock); return conn; } =20 - conn =3D kzalloc_obj(*conn); - if (!conn) + conn =3D kzalloc_obj(*conn, GFP_ATOMIC); + if (!conn) { + spin_unlock(&hcon->proto_lock); return NULL; + } =20 kref_init(&conn->ref); spin_lock_init(&conn->lock); @@ -229,6 +256,8 @@ static struct iso_conn *iso_conn_add(struct hci_conn *h= con) conn->hcon =3D hcon; conn->tx_sn =3D 0; =20 + spin_unlock(&hcon->proto_lock); + BT_DBG("hcon %p conn %p", hcon, conn); =20 return conn; @@ -269,10 +298,12 @@ static void iso_chan_del(struct sock *sk, int err) static void iso_conn_del(struct hci_conn *hcon, int err) __must_hold(&hcon->hdev->lock) { - struct iso_conn *conn =3D hcon->iso_data; + struct iso_conn *conn; struct sock *sk; =20 - conn =3D iso_conn_hold_unless_zero(conn); + spin_lock(&hcon->proto_lock); + conn =3D iso_conn_hold_unless_zero(hcon->iso_data); + spin_unlock(&hcon->proto_lock); if (!conn) return; =20 @@ -296,10 +327,12 @@ static void iso_conn_del(struct hci_conn *hcon, int e= rr) =20 done: /* No sk access to conn->hcon any more (lock_sock + hdev->lock) */ + spin_lock(&hcon->proto_lock); iso_conn_lock(conn); conn->hcon =3D NULL; hcon->iso_data =3D NULL; iso_conn_unlock(conn); + spin_unlock(&hcon->proto_lock); =20 iso_conn_put(conn); } @@ -421,6 +454,8 @@ static int iso_connect_bis(struct sock *sk) iso_pi(sk)->bc_sid =3D hcon->sid; } =20 + lockdep_assert_held(&hcon->hdev->lock); + conn =3D iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -524,6 +559,8 @@ static int iso_connect_cis(struct sock *sk) } } =20 + lockdep_assert_held(&hcon->hdev->lock); + conn =3D iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -855,8 +892,8 @@ static void iso_sock_disconn(struct sock *sk) */ if (bis_sk) { hcon->state =3D BT_OPEN; - hcon->iso_data =3D NULL; - iso_pi(sk)->conn->hcon =3D NULL; + set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags); + iso_sock_clear_timer(sk); iso_chan_del(sk, bt_to_errno(hcon->abort_reason)); sock_put(bis_sk); @@ -1306,6 +1343,8 @@ static int iso_listen_bis(struct sock *sk) goto unlock; } =20 + lockdep_assert_held(&hcon->hdev->lock); + conn =3D iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -2591,7 +2630,10 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struc= t sk_buff *skb, u16 flags) return -ENOENT; } =20 + spin_lock(&hcon->proto_lock); conn =3D iso_conn_hold_unless_zero(hcon->iso_data); + spin_unlock(&hcon->proto_lock); + hcon =3D NULL; =20 hci_dev_unlock(hdev); --=20 2.55.0