averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-08-09 06:14:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: ISO: clear iso_data always when detaching conn from hcon

Browse Source 
When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
iso_sock_release() followed by hci_abort_conn_sync().

Fixes: fbdc4bc472 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pauli Virtanen
2026-07-28 14:45:34 -04:00
committed by Luiz Augusto von Dentz
parent e095f249e2
commit d57e506f6a
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/iso.c
+1
View File
@@ -837,6 +837,7 @@ static void iso_sock_disconn(struct sock *sk)
sk->sk_state = BT_DISCONN;
iso_conn_lock(iso_pi(sk)->conn);
hci_conn_drop(iso_pi(sk)->conn->hcon);
iso_pi(sk)->conn->hcon->iso_data = NULL;
iso_pi(sk)->conn->hcon = NULL;
iso_conn_unlock(iso_pi(sk)->conn);
}