[PATCH] Bluetooth: ISO: fix UAF in iso_conn_ready

[PATCH] Bluetooth: ISO: fix UAF in iso_conn_ready

[Jiale Yao]

When iso_connect_cfm() calls iso_conn_ready(), the latter reads
conn->sk without holding a reference. A concurrent close() on the
ISO socket triggers iso_sock_kill() which frees sk, leading to a
use-after-free when iso_conn_ready() subsequently accesses the
freed sk via lock_sock() and iso_sock_ready().

This was triggered by a vhci-based PoC that races
LE Setup ISO Data Path (0x206e) command completion against
close() on the ISO socket. The crash manifests as a KASAN
null-ptr-deref in iso_connect_cfm() at offset 0x3c from a NULL
pointer, with the call trace:

 iso_connect_cfm+0x311/0x15f0
 hci_cc_le_setup_iso_path+0x46d/0x6f0
 hci_cmd_complete_evt+0x26d/0x990
 hci_event_packet+0x468/0xb40
 hci_rx_work+0x255/0x6e0

Fix by replacing the bare pointer read with iso_sock_hold(conn)
under iso_conn_lock, which atomically elevates the refcount,
and add sock_put() on the exit path where the hold succeeded.

Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 net/bluetooth/iso.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 2e95a153912c..c8103de41cdd 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2074,7 +2074,7 @@ static bool iso_match_dst(struct sock *sk, void *data)
 static void iso_conn_ready(struct iso_conn *conn)
 {
 	struct sock *parent = NULL;
-	struct sock *sk = conn->sk;
+	struct sock *sk;
 	struct hci_ev_le_big_sync_established *ev = NULL;
 	struct hci_ev_le_pa_sync_established *ev2 = NULL;
 	struct hci_ev_le_per_adv_report *ev3 = NULL;
@@ -2083,6 +2083,10 @@ static void iso_conn_ready(struct iso_conn *conn)
 
 	BT_DBG("conn %p", conn);
 
+	iso_conn_lock(conn);
+	sk = iso_sock_hold(conn);
+	iso_conn_unlock(conn);
+
 	if (sk) {
 		/* Attempt to update source address in case of BIS Sender if
 		 * the advertisement is using a random address.
@@ -2103,7 +2107,8 @@ static void iso_conn_ready(struct iso_conn *conn)
 			}
 		}
 
-		iso_sock_ready(conn->sk);
+		iso_sock_ready(sk);
+		sock_put(sk);
 	} else {
 		hcon = conn->hcon;
 		if (!hcon)
-- 
2.34.1

Re: [PATCH] Bluetooth: ISO: fix UAF in iso_conn_ready

[Pauli Virtanen]

Hi,

la, 2026-07-25 kello 18:51 +0800, Jiale Yao kirjoitti:
> When iso_connect_cfm() calls iso_conn_ready(), the latter reads
> conn->sk without holding a reference. A concurrent close() on the
> ISO socket triggers iso_sock_kill() which frees sk, leading to a
> use-after-free when iso_conn_ready() subsequently accesses the
> freed sk via lock_sock() and iso_sock_ready().
> 
> This was triggered by a vhci-based PoC that races
> LE Setup ISO Data Path (0x206e) command completion against
> close() on the ISO socket. The crash manifests as a KASAN
> null-ptr-deref in iso_connect_cfm() at offset 0x3c from a NULL
> pointer, with the call trace:
> 
>  iso_connect_cfm+0x311/0x15f0
>  hci_cc_le_setup_iso_path+0x46d/0x6f0
>  hci_cmd_complete_evt+0x26d/0x990
>  hci_event_packet+0x468/0xb40
>  hci_rx_work+0x255/0x6e0
> 
> Fix by replacing the bare pointer read with iso_sock_hold(conn)
> under iso_conn_lock, which atomically elevates the refcount,
> and add sock_put() on the exit path where the hold succeeded.
> 
> Fixes: ccf74f2390d60 ("Bluetooth: Add BTPROTO_ISO socket type")
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
> ---
>  net/bluetooth/iso.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
> index 2e95a153912c..c8103de41cdd 100644
> --- a/net/bluetooth/iso.c
> +++ b/net/bluetooth/iso.c
> @@ -2074,7 +2074,7 @@ static bool iso_match_dst(struct sock *sk, void *data)
>  static void iso_conn_ready(struct iso_conn *conn)
>  {
>  	struct sock *parent = NULL;
> -	struct sock *sk = conn->sk;
> +	struct sock *sk;
>  	struct hci_ev_le_big_sync_established *ev = NULL;
>  	struct hci_ev_le_pa_sync_established *ev2 = NULL;
>  	struct hci_ev_le_per_adv_report *ev3 = NULL;
> @@ -2083,6 +2083,10 @@ static void iso_conn_ready(struct iso_conn *conn)
>  
>  	BT_DBG("conn %p", conn);
>  
> +	iso_conn_lock(conn);
> +	sk = iso_sock_hold(conn);
> +	iso_conn_unlock(conn);
> +
>  	if (sk) {
>  		/* Attempt to update source address in case of BIS Sender if
>  		 * the advertisement is using a random address.
> @@ -2103,7 +2107,8 @@ static void iso_conn_ready(struct iso_conn *conn)
>  			}
>  		}
>  
> -		iso_sock_ready(conn->sk);
> +		iso_sock_ready(sk);

This should re-check conn->sk and socket state again after acquiring
lock_sock to avoid state transition on closed socket.

See
https://lore.kernel.org/linux-bluetooth/b9341fe78dbe1ddd550b5099e6c87006fdb4b3e5.camel@iki.fi/T/#m4ddb5fb1add7bd2375de3ce5a92335922dd14abd


> +		sock_put(sk);
>  	} else {
>  		hcon = conn->hcon;
>  		if (!hcon)

-- 
Pauli Virtanen

RE: Bluetooth: ISO: fix UAF in iso_conn_ready

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1981 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1134356

---Test result---

Test Summary:
CheckPatch                    PASS      0.71 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       PASS      0.31 seconds
SubjectPrefix                 PASS      0.39 seconds
BuildKernel                   PASS      27.09 seconds
CheckAllWarning               PASS      30.08 seconds
CheckSparse                   PASS      28.59 seconds
BuildKernel32                 PASS      26.24 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      498.28 seconds
TestRunner_iso-tester         FAIL      88.01 seconds
IncrementalBuild              PASS      25.99 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found
##############################
Test: TestRunner_iso-tester - FAIL
Desc: Run iso-tester with test-runner
Output:
Total: 141, Passed: 134 (95.0%), Failed: 7, Not Run: 0

Failed Test Cases
ISO Disconnect - Success                             Timed out    2.049 seconds
ISO Reconnect - Success                              Timed out    1.995 seconds
ISO Reconnect Send and Receive #16 - Success         Timed out    1.994 seconds
ISO Reconnect AC 6(i) - Success                      Timed out    2.606 seconds
ISO Reconnect AC 6(ii) - Success                     Timed out    2.005 seconds
ISO Broadcaster Reconnect - Success                  Timed out    1.922 seconds
ISO Broadcaster Receiver Defer Reconnect - Success   Timed out    2.328 seconds


https://github.com/bluez/bluetooth-next/pull/495

---
Regards,
Linux Bluetooth