[PATCH] Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[PATCH] Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[Aldo Ariel Panzardo]

hci_conn_link() takes a lifetime reference to its parent with
hci_conn_get(), but only takes an operational hold on the child.
hci_conn_unlink() later balances both a hold and a reference on the
parent.

The SCO and CIS paths pass a parent acquired from a connect helper, so
it already has a hold. For an additional BIS, hci_bind_bis() obtains the
parent from hci_conn_hash_lookup_big(), which returns a bare pointer.
Unlinking the child then drops the parent's existing hold and can
schedule it for disconnection while its socket is still using it.

Take a hold on the parent before linking it and drop that hold if linking
fails. A successful link transfers the hold to hci_conn_unlink().

Fixes: fa224d0c094a ("Bluetooth: ISO: Reassociate a socket with an active BIS")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 net/bluetooth/hci_conn.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b1f911fd4..09a6e0240 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -2342,10 +2342,13 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
 	parent = hci_conn_hash_lookup_big(hdev,
 					  conn->iso_qos.bcast.big);
 	if (parent && parent != conn) {
+		hci_conn_hold(parent);
 		link = hci_conn_link(parent, conn);
 		hci_conn_drop(conn);
-		if (!link)
+		if (!link) {
+			hci_conn_drop(parent);
 			return ERR_PTR(-ENOLINK);
+		}
 	}
 
 	return conn;
-- 
2.43.0

RE: Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 3111 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1165736/

---Test result---

Test Summary:
CheckPatch                    PASS      0.71 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.11 seconds
GitLint                       PASS      0.42 seconds
SubjectPrefix                 PASS      0.19 seconds
BuildKernel                   PASS      28.25 seconds
CheckAllWarning               PASS      36.13 seconds
CheckSparse                   PASS      34.95 seconds
BuildKernel32                 PASS      28.10 seconds
CheckKernelLLVM               PASS      31.01 seconds
TestRunnerSetup               PASS      722.97 seconds
TestRunner_l2cap-tester       FAIL      9.01 seconds
TestRunner_iso-tester         FAIL      7.52 seconds
TestRunner_bnep-tester        FAIL      7.67 seconds
TestRunner_mgmt-tester        FAIL      7.59 seconds
TestRunner_rfcomm-tester      FAIL      7.55 seconds
TestRunner_sco-tester         FAIL      7.65 seconds
TestRunner_ioctl-tester       FAIL      7.68 seconds
TestRunner_mesh-tester        FAIL      7.66 seconds
TestRunner_smp-tester         FAIL      7.66 seconds
TestRunner_userchan-tester    FAIL      7.55 seconds
TestRunner_6lowpan-tester     FAIL      7.62 seconds
IncrementalBuild              PASS      26.77 seconds

Details
##############################
Test: TestRunner_l2cap-tester - FAIL
Desc: Run l2cap-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_bnep-tester - FAIL
Desc: Run bnep-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_rfcomm-tester - FAIL
Desc: Run rfcomm-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_sco-tester - FAIL
Desc: Run sco-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_ioctl-tester - FAIL
Desc: Run ioctl-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_smp-tester - FAIL
Desc: Run smp-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_userchan-tester - FAIL
Desc: Run userchan-tester with test-runner
Output:
No test result found
##############################
Test: TestRunner_6lowpan-tester - FAIL
Desc: Run 6lowpan-tester with test-runner
Output:
No test result found


https://github.com/bluez/bluetooth-next/pull/776

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 15 Sep 2026 13:03:32 -0300 you wrote:
> hci_conn_link() takes a lifetime reference to its parent with
> hci_conn_get(), but only takes an operational hold on the child.
> hci_conn_unlink() later balances both a hold and a reference on the
> parent.
> 
> The SCO and CIS paths pass a parent acquired from a connect helper, so
> it already has a hold. For an additional BIS, hci_bind_bis() obtains the
> parent from hci_conn_hash_lookup_big(), which returns a bare pointer.
> Unlinking the child then drops the parent's existing hold and can
> schedule it for disconnection while its socket is still using it.
> 
> [...]

Here is the summary with links:
  - Bluetooth: ISO: balance the parent hold in hci_bind_bis()
    https://git.kernel.org/bluetooth/bluetooth-next/c/4c94557dd025

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html