Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback

There is theoretical UAF if the conn is freed while the hci_sync task is
running.

Hold refcount to avoid that. Handle NULL hcon, return 0 + do nothing to
match the previous behavior.

Fixes: 024421cf3992 ("Bluetooth: hci_conn: Fix not setting timeout for BIG Create Sync")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index 79cd52974eb030ab7b1e9530585040eeb63f67be..cdc7dff7054c725609f698ddc738f464d5eb477d 100644 (file)
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -7522,10 +7522,12 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err)
        bt_dev_dbg(hdev, "err %d", err);
 
        if (err == -ECANCELED)
-               return;
+               goto done;
 
-       if (hci_conn_valid(hdev, conn))
-               clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
+       clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags);
+
+done:
+       hci_conn_put(conn);
 }
 
 static int hci_le_big_create_sync(struct hci_dev *hdev, void *data)
@@ -7577,8 +7579,14 @@ int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn)
 {
        int err;
 
-       err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn,
+       if (!conn)
+               return 0;
+
+       err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync,
+                                     hci_conn_get(conn),
                                      create_big_complete);
+       if (err)
+               hci_conn_put(conn);
        return (err == -EEXIST) ? 0 : err;
 }