| Message ID | 7dd7bff24c3f6765728aec12b2e96be792d8f6d7.1686252492.git.pav@iki.fi |
|---|---|
| State | New |
| Headers | show |
| Series | Bluetooth: ISO-related concurrency fixes | expand |
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 7c199f7361f7..fb80923bf965 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2784,6 +2784,12 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) hci_enable_advertising(hdev); } + /* Tell ISO sockets the conn went away, before we delete it, + * because they do not hold reference. + */ + if (conn->type == ISO_LINK) + hci_disconn_cfm(conn, HCI_ERROR_LOCAL_HOST_TERM); + goto done; }
In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. When this occurs for ISO connections, which refer to the conn without hci_conn_get, disconn_cfm must be called otherwise use-after-free occurs. Currently ISO socket Disconnect often fails because we try disconnect them after disconnecting ACL when they are already implicitly disconnected (Core v5.3 Vol 4 Part E Sec 7.1.6). Trace from logs: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Pauli Virtanen <pav@iki.fi> --- Notes: This might be necessary for all socket types, not sure about that yet. net/bluetooth/hci_event.c | 6 ++++++ 1 file changed, 6 insertions(+)