When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
iso_sock_release() followed by hci_abort_conn_sync().

Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---

Notes:
    The locking around iso_data and conn->hcon access looks wrong here,
    there's very likely concurrency bugs with UAF here.  These should be
    fixed in separate series.

 net/bluetooth/iso.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 2e95a153912c..babba61eb335 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -837,6 +837,7 @@ static void iso_sock_disconn(struct sock *sk)
 	sk->sk_state = BT_DISCONN;
 	iso_conn_lock(iso_pi(sk)->conn);
 	hci_conn_drop(iso_pi(sk)->conn->hcon);
+	iso_pi(sk)->conn->hcon->iso_data = NULL;
 	iso_pi(sk)->conn->hcon = NULL;
 	iso_conn_unlock(iso_pi(sk)->conn);
 }
-- 
2.55.0

Hi,

ma, 2026-07-20 kello 17:53 +0300, Pauli Virtanen kirjoitti:
> When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
> necessary, otherwise later iso_conn_free() will UAF.
> 
> Fix clearing of iso_data in iso_sock_disconn()
> 
> Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
> iso_sock_release() followed by hci_abort_conn_sync().
> 
> Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
> Signed-off-by: Pauli Virtanen <pav@iki.fi>
> ---
> 
> Notes:
>     The locking around iso_data and conn->hcon access looks wrong here,
>     there's very likely concurrency bugs with UAF here.  These should be
>     fixed in separate series.
> 
>  net/bluetooth/iso.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> index 2e95a153912c..babba61eb335 100644
> --- a/net/bluetooth/iso.c
> +++ b/net/bluetooth/iso.c
> @@ -837,6 +837,7 @@ static void iso_sock_disconn(struct sock *sk)
>  	sk->sk_state = BT_DISCONN;
>  	iso_conn_lock(iso_pi(sk)->conn);
>  	hci_conn_drop(iso_pi(sk)->conn->hcon);
> +	iso_pi(sk)->conn->hcon->iso_data = NULL;
>  	iso_pi(sk)->conn->hcon = NULL;
>  	iso_conn_unlock(iso_pi(sk)->conn);
>  }

Well, this was wrong as noted by Sashiko, hcon shall be detached from
conn only via iso_conn_put(), we should just drop here instead and
maybe avoid a second drop in iso_conn_free().

-> v2

-- 
Pauli Virtanen