--- /dev/null
+From b819db93d73f4593636299e229914052b89e3ef2 Mon Sep 17 00:00:00 2001
+From: Pauli Virtanen <pav@iki.fi>
+Date: Sun, 12 Apr 2026 21:47:42 +0300
+Subject: Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready
+
+From: Pauli Virtanen <pav@iki.fi>
+
+commit b819db93d73f4593636299e229914052b89e3ef2 upstream.
+
+sco_conn_ready calls sleeping functions under conn->lock spinlock.
+
+The critical section can be reduced: conn->hcon is modified only with
+hdev->lock held. It is guaranteed to be held in sco_conn_ready, so
+conn->lock is not needed to guard it.
+
+Move taking conn->lock after lock_sock(parent). This also follows the
+lock ordering lock_sock() > conn->lock elsewhere in the file.
+
+Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/sco.c | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -1328,26 +1328,24 @@ static void sco_conn_ready(struct sco_co
+ sk->sk_state_change(sk);
+ release_sock(sk);
+ } else {
+- sco_conn_lock(conn);
+-
+- if (!conn->hcon) {
+- sco_conn_unlock(conn);
++ if (!conn->hcon)
+ return;
+- }
++
++ lockdep_assert_held(&conn->hcon->hdev->lock);
+
+ parent = sco_get_sock_listen(&conn->hcon->src);
+- if (!parent) {
+- sco_conn_unlock(conn);
++ if (!parent)
+ return;
+- }
+
+ lock_sock(parent);
+
++ sco_conn_lock(conn);
++
+ sk = sco_sock_alloc(sock_net(parent), NULL,
+ BTPROTO_SCO, GFP_ATOMIC, 0);
+ if (!sk) {
+- release_sock(parent);
+ sco_conn_unlock(conn);
++ release_sock(parent);
+ return;
+ }
+
+@@ -1367,9 +1365,9 @@ static void sco_conn_ready(struct sco_co
+ /* Wake up parent */
+ parent->sk_data_ready(parent);
+
+- release_sock(parent);
+-
+ sco_conn_unlock(conn);
++
++ release_sock(parent);
+ }
+ }
+
--- /dev/null
+From 4e37f6452d586b95c346a9abdd2fb80b67794f39 Mon Sep 17 00:00:00 2001
+From: Pauli Virtanen <pav@iki.fi>
+Date: Sat, 18 Apr 2026 18:41:12 +0300
+Subject: Bluetooth: SCO: hold sk properly in sco_conn_ready
+
+From: Pauli Virtanen <pav@iki.fi>
+
+commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 upstream.
+
+sk deref in sco_conn_ready must be done either under conn->lock, or
+holding a refcount, to avoid concurrent close. conn->sk and parent sk is
+currently accessed without either, and without checking parent->sk_state:
+
+ [Task 1] [Task 2]
+ sco_sock_release
+ sco_conn_ready
+ sk = conn->sk
+ lock_sock(sk)
+ conn->sk = NULL
+ lock_sock(sk)
+ release_sock(sk)
+ sco_sock_kill(sk)
+ UAF on sk deref
+
+and similarly for access to sco_get_sock_listen() return value.
+
+Fix possible UAF by holding sk refcount in sco_conn_ready() and making
+sco_get_sock_listen() increase refcount. Also recheck after lock_sock
+that the socket is still valid. Adjust conn->sk locking so it's
+protected also by lock_sock() of the associated socket if any.
+
+Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO")
+Signed-off-by: Pauli Virtanen <pav@iki.fi>
+Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bluetooth/sco.c | 44 ++++++++++++++++++++++++++++++++------------
+ 1 file changed, 32 insertions(+), 12 deletions(-)
+
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -410,9 +410,13 @@ static struct sock *sco_get_sock_listen(
+ sk1 = sk;
+ }
+
++ sk = sk ? sk : sk1;
++ if (sk)
++ sock_hold(sk);
++
+ read_unlock(&sco_sk_list.lock);
+
+- return sk ? sk : sk1;
++ return sk;
+ }
+
+ static void sco_sock_destruct(struct sock *sk)
+@@ -452,11 +456,13 @@ static void sco_sock_kill(struct sock *s
+ BT_DBG("sk %p state %d", sk, sk->sk_state);
+
+ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
++ lock_sock(sk);
+ if (sco_pi(sk)->conn) {
+ sco_conn_lock(sco_pi(sk)->conn);
+ sco_pi(sk)->conn->sk = NULL;
+ sco_conn_unlock(sco_pi(sk)->conn);
+ }
++ release_sock(sk);
+
+ /* Kill poor orphan */
+ bt_sock_unlink(&sco_sk_list, sk);
+@@ -1316,17 +1322,28 @@ static int sco_sock_release(struct socke
+
+ static void sco_conn_ready(struct sco_conn *conn)
+ {
+- struct sock *parent;
+- struct sock *sk = conn->sk;
++ struct sock *parent, *sk;
++
++ sco_conn_lock(conn);
++ sk = sco_sock_hold(conn);
++ sco_conn_unlock(conn);
+
+ BT_DBG("conn %p", conn);
+
+ if (sk) {
+ lock_sock(sk);
+- sco_sock_clear_timer(sk);
+- sk->sk_state = BT_CONNECTED;
+- sk->sk_state_change(sk);
++
++ /* conn->sk may have become NULL if racing with sk close, but
++ * due to held hdev->lock, it can't become different sk.
++ */
++ if (conn->sk) {
++ sco_sock_clear_timer(sk);
++ sk->sk_state = BT_CONNECTED;
++ sk->sk_state_change(sk);
++ }
++
+ release_sock(sk);
++ sock_put(sk);
+ } else {
+ if (!conn->hcon)
+ return;
+@@ -1341,13 +1358,15 @@ static void sco_conn_ready(struct sco_co
+
+ sco_conn_lock(conn);
+
++ /* hdev->lock guarantees conn->sk == NULL still here */
++
++ if (parent->sk_state != BT_LISTEN)
++ goto release;
++
+ sk = sco_sock_alloc(sock_net(parent), NULL,
+ BTPROTO_SCO, GFP_ATOMIC, 0);
+- if (!sk) {
+- sco_conn_unlock(conn);
+- release_sock(parent);
+- return;
+- }
++ if (!sk)
++ goto release;
+
+ sco_sock_init(sk, parent);
+
+@@ -1365,9 +1384,10 @@ static void sco_conn_ready(struct sco_co
+ /* Wake up parent */
+ parent->sk_data_ready(parent);
+
++release:
+ sco_conn_unlock(conn);
+-
+ release_sock(parent);
++ sock_put(parent);
+ }
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
