[PATCH] Bluetooth: SCO: Fix use-after-free in sco_conn_ready() due to missing sock_hold

[Hyunwoo Kim <imv4bel@gmail.com>]

sco_get_sock_listen() returns a pointer to a listening socket without
incrementing its reference count. If the listening socket is concurrently
closed and freed before sco_conn_ready() calls lock_sock(parent), a
use-after-free occurs. The listening socket has no sco_conn association
(sco_pi(sk)->conn == NULL), so sco_conn_lock does not prevent it.

Fix by adding sock_hold()/sock_put() in sco_get_sock_listen() following
the iso_get_sock() pattern.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/bluetooth/sco.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index e7db50165879..7ad6d9208de5 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -449,14 +449,23 @@ static struct sock *sco_get_sock_listen(bdaddr_t *src)
 			continue;
 
 		/* Exact match. */
-		if (!bacmp(&sco_pi(sk)->src, src))
+		if (!bacmp(&sco_pi(sk)->src, src)) {
+			sock_hold(sk);
 			break;
+		}
 
 		/* Closest match */
-		if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY))
+		if (!bacmp(&sco_pi(sk)->src, BDADDR_ANY)) {
+			if (sk1)
+				sock_put(sk1);
 			sk1 = sk;
+			sock_hold(sk1);
+		}
 	}
 
+	if (sk && sk1)
+		sock_put(sk1);
+
 	read_unlock(&sco_sk_list.lock);
 
 	return sk ? sk : sk1;
@@ -1376,6 +1385,7 @@ static void sco_conn_ready(struct sco_conn *conn)
 		if (!sk) {
 			release_sock(parent);
 			sco_conn_unlock(conn);
+			sock_put(parent);
 			return;
 		}
 
@@ -1399,6 +1409,7 @@ static void sco_conn_ready(struct sco_conn *conn)
 		release_sock(parent);
 
 		sco_conn_unlock(conn);
+		sock_put(parent);
 	}
 }
 
-- 
2.43.0