[PATCH] Bluetooth: ISO: clear iso_data always when detaching conn from hcon

[PATCH] Bluetooth: ISO: clear iso_data always when detaching conn from hcon

[Pauli Virtanen]

When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
iso_sock_release() followed by hci_abort_conn_sync().

Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
---

Notes:
    The locking around iso_data and conn->hcon access looks wrong here,
    there's very likely concurrency bugs with UAF here.  These should be
    fixed in separate series.

 net/bluetooth/iso.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 2e95a153912c..babba61eb335 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -837,6 +837,7 @@ static void iso_sock_disconn(struct sock *sk)
 	sk->sk_state = BT_DISCONN;
 	iso_conn_lock(iso_pi(sk)->conn);
 	hci_conn_drop(iso_pi(sk)->conn->hcon);
+	iso_pi(sk)->conn->hcon->iso_data = NULL;
 	iso_pi(sk)->conn->hcon = NULL;
 	iso_conn_unlock(iso_pi(sk)->conn);
 }
-- 
2.55.0

Re: [PATCH] Bluetooth: ISO: clear iso_data always when detaching conn from hcon

[Pauli Virtanen]

Hi,

ma, 2026-07-20 kello 17:53 +0300, Pauli Virtanen kirjoitti:
> When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
> necessary, otherwise later iso_conn_free() will UAF.
> 
> Fix clearing of iso_data in iso_sock_disconn()
> 
> Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
> iso_sock_release() followed by hci_abort_conn_sync().
> 
> Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
> Signed-off-by: Pauli Virtanen <pav@iki.fi>
> ---
> 
> Notes:
>     The locking around iso_data and conn->hcon access looks wrong here,
>     there's very likely concurrency bugs with UAF here.  These should be
>     fixed in separate series.
> 
>  net/bluetooth/iso.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> index 2e95a153912c..babba61eb335 100644
> --- a/net/bluetooth/iso.c
> +++ b/net/bluetooth/iso.c
> @@ -837,6 +837,7 @@ static void iso_sock_disconn(struct sock *sk)
>  	sk->sk_state = BT_DISCONN;
>  	iso_conn_lock(iso_pi(sk)->conn);
>  	hci_conn_drop(iso_pi(sk)->conn->hcon);
> +	iso_pi(sk)->conn->hcon->iso_data = NULL;
>  	iso_pi(sk)->conn->hcon = NULL;
>  	iso_conn_unlock(iso_pi(sk)->conn);
>  }

Well, this was wrong as noted by Sashiko, hcon shall be detached from
conn only via iso_conn_put(), we should just drop here instead and
maybe avoid a second drop in iso_conn_free().

-> v2

-- 
Pauli Virtanen

RE: Bluetooth: ISO: clear iso_data always when detaching conn from hcon

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1981 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1130974

---Test result---

Test Summary:
CheckPatch                    PASS      0.56 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.24 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      25.05 seconds
CheckAllWarning               PASS      27.99 seconds
CheckSparse                   PASS      26.38 seconds
BuildKernel32                 PASS      24.53 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      461.83 seconds
TestRunner_iso-tester         FAIL      98.86 seconds
IncrementalBuild              PASS      23.07 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
Total: 141, Passed: 134 (95.0%), Failed: 7, Not Run: 0

Failed Test Cases
ISO Disconnect - Success                             Timed out    2.623 seconds
ISO Reconnect - Success                              Timed out    1.990 seconds
ISO Reconnect Send and Receive #16 - Success         Timed out    1.998 seconds
ISO Reconnect AC 6(i) - Success                      Timed out    2.307 seconds
ISO Reconnect AC 6(ii) - Success                     Timed out    1.999 seconds
ISO Broadcaster Reconnect - Success                  Timed out    2.731 seconds
ISO Broadcaster Receiver Defer Reconnect - Success   Timed out    2.326 seconds


https://github.com/bluez/bluetooth-next/pull/462

---
Regards,
Linux Bluetooth