Commit 246b435a authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: ISO: Fix UAF on iso_sock_timeout 



conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
iso_sk_list.

Fixes: ccf74f23 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 1bf4470a

net/bluetooth/iso.c

+12 −6
Original line number Diff line number Diff line
@@ -93,6 +93,16 @@ static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst, 
#define ISO_CONN_TIMEOUT	(HZ * 40)

#define ISO_DISCONN_TIMEOUT	(HZ * 2)



static struct sock *iso_sock_hold(struct iso_conn *conn)

{

	if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))

		return NULL;



	sock_hold(conn->sk);



	return conn->sk;

}



static void iso_sock_timeout(struct work_struct *work)

{

	struct iso_conn *conn = container_of(work, struct iso_conn,
@@ -100,9 +110,7 @@ static void iso_sock_timeout(struct work_struct *work) 
	struct sock *sk;



	iso_conn_lock(conn);

	sk = conn->sk;

	if (sk)

		sock_hold(sk);

	sk = iso_sock_hold(conn);

	iso_conn_unlock(conn);



	if (!sk)
@@ -209,9 +217,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err) 


	/* Kill socket */

	iso_conn_lock(conn);

	sk = conn->sk;

	if (sk)

		sock_hold(sk);

	sk = iso_sock_hold(conn);

	iso_conn_unlock(conn);



	if (sk) {