[PATCH 6.1.y] Bluetooth: ISO: ensure no dangling hcon references in iso_conn

[PATCH 6.1.y] Bluetooth: ISO: ensure no dangling hcon references in iso_conn

[Daniel Pereira]

commit aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb upstream.

After iso_conn_del(), ISO sockets should not dereference the hcon any
more.  Currently, clearing iso_conn::hcon relies on iso_conn_del()
releasing the last reference to the iso_conn.

Simplify this by explicitly clearing conn->hcon in iso_conn_del(), to
avoid more complex reasoning on races about who holds the last
reference.

[ Daniel Pereira ]
Backport notes:
- Adjusted the context in iso_conn_del() as 6.1.y handles iso_conn freeing
  without refcounting (kfree(conn)). Explicitly cleared conn->hcon under
  iso_conn_lock() right before freeing to maintain the safety invariant and
  prevent any concurrent socket accesses from holding dangling hcon pointers.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Daniel Pereira <danielmaraboo@gmail.com>
---
 net/bluetooth/iso.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index aad4baec9..ef31fcd47 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -183,6 +183,7 @@ static void iso_chan_del(struct sock *sk, int err)
 }
 
 static void iso_conn_del(struct hci_conn *hcon, int err)
+	__must_hold(&hcon->hdev->lock)
 {
 	struct iso_conn *conn = hcon->iso_data;
 	struct sock *sk;
@@ -208,6 +209,9 @@ static void iso_conn_del(struct hci_conn *hcon, int err)
 	/* Ensure no more work items will run before freeing conn. */
 	cancel_delayed_work_sync(&conn->timeout_work);
 
+	iso_conn_lock(conn);
+	conn->hcon = NULL;
+	iso_conn_unlock(conn);
 	hcon->iso_data = NULL;
 	kfree(conn);
 }
@@ -1669,6 +1673,7 @@ static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)
 }
 
 static void iso_disconn_cfm(struct hci_conn *hcon, __u8 reason)
+	__must_hold(&hcon->hdev->lock)
 {
 	if (hcon->type != ISO_LINK)
 		return;
-- 
2.47.3

Re: [PATCH 6.1.y] Bluetooth: ISO: ensure no dangling hcon references in iso_conn

[Sasha Levin]

> commit aa9f7cb2bd3a2be998ceb739fc9a2f986eba43eb upstream.
>
> After iso_conn_del(), ISO sockets should not dereference the hcon any
> more. Currently, clearing iso_conn::hcon relies on iso_conn_del()
> releasing the last reference to the iso_conn.

Thanks, but this doesn't do anything on 6.1.y. iso_conn isn't
kref-refcounted there yet - dc26097bdb86 came later - so iso_conn_del()
kfree()s conn two statements after your `conn->hcon = NULL`, and
nothing can observe the store.

-- 
Thanks,
Sasha