Bluetooth: ISO: Fix UAF on iso_sock_timeout

[ Upstream commit 246b435ad668596aa0e2bbb9d491b6413861211a ]

conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
iso_sk_list.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index c9eefb43bf47e36902853e770e160224c4f07f93..7a83e400ac77a0a0df41b206643bae6fc031631b 100644 (file)
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -93,6 +93,16 @@ static struct sock *iso_get_sock(bdaddr_t *src, bdaddr_t *dst,
 #define ISO_CONN_TIMEOUT       (HZ * 40)
 #define ISO_DISCONN_TIMEOUT    (HZ * 2)
 
+static struct sock *iso_sock_hold(struct iso_conn *conn)
+{
+       if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))
+               return NULL;
+
+       sock_hold(conn->sk);
+
+       return conn->sk;
+}
+
 static void iso_sock_timeout(struct work_struct *work)
 {
        struct iso_conn *conn = container_of(work, struct iso_conn,
@@ -100,9 +110,7 @@ static void iso_sock_timeout(struct work_struct *work)
        struct sock *sk;
 
        iso_conn_lock(conn);
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = iso_sock_hold(conn);
        iso_conn_unlock(conn);
 
        if (!sk)
@@ -209,9 +217,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err)
 
        /* Kill socket */
        iso_conn_lock(conn);
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = iso_sock_hold(conn);
        iso_conn_unlock(conn);
 
        if (sk) {