]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
Bluetooth: ISO: clear iso_data always when detaching conn from hcon
authorPauli Virtanen <pav@iki.fi>
Mon, 20 Jul 2026 14:53:33 +0000 (17:53 +0300)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tue, 28 Jul 2026 18:45:34 +0000 (14:45 -0400)
commitd57e506f6a1e3929611340fae87c1e4823f4d85c
tree3d3907cdabd90b061788eabe78b53820e5974586
parente095f249e2209674f6366f6db0383a2b96e19239
Bluetooth: ISO: clear iso_data always when detaching conn from hcon

When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
necessary, otherwise later iso_conn_free() will UAF.

Fix clearing of iso_data in iso_sock_disconn()

Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
iso_sock_release() followed by hci_abort_conn_sync().

Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/iso.c