Re: [PATCH 1/2] Bluetooth: ISO: fix UAF in iso_recv_frame

[patchwork-bot+bluetooth@kernel.org]

Hello:

This series was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Wed, 27 May 2026 04:59:17 +0000 you wrote:
> iso_recv_frame reads conn->sk under iso_conn_lock but releases the lock
> before using sk, with no reference held. A concurrent iso_sock_kill()
> can free sk in that window, causing use-after-free on sk->sk_state and
> sock_queue_rcv_skb().
> 
> Fix by replacing the bare pointer read with iso_sock_hold(conn), which
> calls sock_hold() while the spinlock is held, atomically elevating the
> refcount before the lock drops. Add a drop_put label so sock_put() is
> called on all exit paths where the hold succeeded.
> 
> [...]

Here is the summary with links:
  - [1/2] Bluetooth: ISO: fix UAF in iso_recv_frame
    https://git.kernel.org/bluetooth/bluetooth-next/c/7e3545cc3d1a
  - [2/2] Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock
    https://git.kernel.org/bluetooth/bluetooth-next/c/7978ae58aafb

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html