Re: [PATCH] Bluetooth: SCO: hold sk properly in sco_conn_ready

Re: [PATCH] Bluetooth: SCO: hold sk properly in sco_conn_ready

[Lee Jones]

Stable Team,

On Sat, 18 Apr 2026, Pauli Virtanen wrote:

> sk deref in sco_conn_ready must be done either under conn->lock, or
> holding a refcount, to avoid concurrent close. conn->sk and parent sk is
> currently accessed without either, and without checking parent->sk_state:
> 
>     [Task 1]            [Task 2]
>                         sco_sock_release
>     sco_conn_ready
>       sk = conn->sk
>                           lock_sock(sk)
>                             conn->sk = NULL
>       lock_sock(sk)
>                           release_sock(sk)
>                           sco_sock_kill(sk)
>        UAF on sk deref
> 
> and similarly for access to sco_get_sock_listen() return value.
> 
> Fix possible UAF by holding sk refcount in sco_conn_ready() and making
> sco_get_sock_listen() increase refcount. Also recheck after lock_sock
> that the socket is still valid.  Adjust conn->sk locking so it's
> protected also by lock_sock() of the associated socket if any.
> 
> Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO")
> Signed-off-by: Pauli Virtanen <pav@iki.fi>
> ---
> 
> Notes:
>     There's still several known race conditions in sco.c, if you look at the
>     sco_conn_put/free and hcon->sco_data access. A redesign could make these
>     locking issues simpler:
>     
>     https://lore.kernel.org/all/5ac8c40b96052cb320c4ee1083d37818ac5d90cc.1776025103.git.pav@iki.fi/
> 
>  net/bluetooth/sco.c | 44 ++++++++++++++++++++++++++++++++------------
>  1 file changed, 32 insertions(+), 12 deletions(-)

Could we have this and its dependency in all Stable branches bar
linux-5.10.y please?

Dep:
  b819db93d73f ("Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready")

Fix:
  4e37f6452d58 ("Bluetooth: SCO: hold sk properly in sco_conn_ready")

Both patches apply cleanly and survive basic build testing on ARM,
ARM66, X86, PPC and MIPS.

-- 
Lee Jones