[PATCH] Bluetooth: ISO: Reject concurrent BIS listener setup

[PATCH] Bluetooth: ISO: Reject concurrent BIS listener setup

[Chengfeng Ye]

iso_sock_listen() drops the socket lock before calling iso_listen_bis()
to preserve the hdev->lock ordering. Two concurrent listen() calls on
the same broadcast socket can therefore both observe BT_BOUND. Caller
A can attach connA and release the locks, then caller B can acquire
them and attach connB before A publishes BT_LISTEN.

__iso_chan_add() checks whether connB already has a socket, but not
whether the socket already has a connection. The second attachment
overwrites iso_pi(sk)->conn, leaking the connA reference and leaving
connA->sk intact. Socket teardown follows connB, so later events on
connA can cause a stale socket access.

Recheck BT_BOUND and require iso_pi(sk)->conn to be NULL after taking
both the HCI device and socket locks in iso_listen_bis(). The connection
check also covers the interval between attachment and publication of
BT_LISTEN. Reject a competing setup with -EBADFD through the existing
unlock path before allocating another connection.

A recorded KASAN report from an instrumented kernel shows:

  BUG: KASAN: slab-use-after-free in iso_sock_hold+0x119/0x1f0
  Call Trace:
   iso_sock_hold+0x119/0x1f0
   iso_conn_del+0xe4/0x270
   hci_disconn_complete_evt+0x351/0x8c0
   hci_event_packet+0x71b/0xb20
   hci_rx_work+0x293/0x730

  Allocated by task 93:
   sk_prot_alloc+0x113/0x220
   sk_alloc+0x2b/0x6d0
   bt_sock_alloc+0x29/0x370
   iso_sock_alloc.constprop.0+0x19/0x300
   iso_sock_create+0x94/0x100

  Freed by task 93:
   kfree+0x121/0x3c0
   __sk_destruct+0x42b/0x540
   iso_sock_release+0x29d/0x340
   __sock_release+0xa1/0x260
   sock_close+0x10/0x20

Fixes: 168e28305b87 ("Bluetooth: iso: Fix circular lock in iso_listen_bis")
Cc: stable@vger.kernel.org
Assisted-by: GPT-6 Astra
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
---
 net/bluetooth/iso.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 7657c2a0abbf..2e70c0df9ef3 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1340,6 +1340,11 @@ static int iso_listen_bis(struct sock *sk)
 	hci_dev_lock(hdev);
 	lock_sock(sk);
 
+	if (sk->sk_state != BT_BOUND || iso_pi(sk)->conn) {
+		err = -EBADFD;
+		goto unlock;
+	}
+
 	/* Fail if user set invalid QoS */
 	if (iso_pi(sk)->qos_user_set && !check_bcast_qos(&iso_pi(sk)->qos)) {
 		iso_pi(sk)->qos = default_qos;
-- 
2.43.0

RE: Bluetooth: ISO: Reject concurrent BIS listener setup

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1073 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1179170/

---Test result---

Test Summary:
CheckPatch                    PASS      0.64 seconds
VerifyFixes                   PASS      0.15 seconds
VerifySignedoff               PASS      0.10 seconds
GitLint                       PASS      0.27 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      27.08 seconds
CheckAllWarning               PASS      30.87 seconds
CheckSparse                   PASS      32.82 seconds
BuildKernel32                 PASS      27.21 seconds
CheckKernelLLVM               PASS      28.44 seconds
TestRunnerSetup               PASS      671.77 seconds
TestRunner_iso-tester         PASS      16.13 seconds
IncrementalBuild              PASS      30.35 seconds



https://github.com/bluez/bluetooth-next/pull/857

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: ISO: Reject concurrent BIS listener setup

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon,  5 Oct 2026 00:25:48 +0800 you wrote:
> iso_sock_listen() drops the socket lock before calling iso_listen_bis()
> to preserve the hdev->lock ordering. Two concurrent listen() calls on
> the same broadcast socket can therefore both observe BT_BOUND. Caller
> A can attach connA and release the locks, then caller B can acquire
> them and attach connB before A publishes BT_LISTEN.
> 
> __iso_chan_add() checks whether connB already has a socket, but not
> whether the socket already has a connection. The second attachment
> overwrites iso_pi(sk)->conn, leaking the connA reference and leaving
> connA->sk intact. Socket teardown follows connB, so later events on
> connA can cause a stale socket access.
> 
> [...]

Here is the summary with links:
  - Bluetooth: ISO: Reject concurrent BIS listener setup
    https://git.kernel.org/bluetooth/bluetooth-next/c/555ff78fa719

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html