Re: [PATCH] Bluetooth: ISO: clear iso_data always when detaching conn from hcon

Hi Luiz,

ti, 2026-07-21 kello 19:40 +0000, [email protected]
kirjoitti:
> Hello:
> 
> This patch was applied to bluetooth/bluetooth-next.git (master)
> by Luiz Augusto von Dentz <[email protected]>:
> 
> On Mon, 20 Jul 2026 17:53:33 +0300 you wrote:
> > When setting conn->hcon = NULL, also conn->hcon->iso_data = NULL is
> > necessary, otherwise later iso_conn_free() will UAF.
> > 
> > Fix clearing of iso_data in iso_sock_disconn()
> > 
> > Fixes KASAN: slab-use-after-free in iso_conn_hold_unless_zero on
> > iso_sock_release() followed by hci_abort_conn_sync().
> > 
> > [...]
> 
> Here is the summary with links:
>   - Bluetooth: ISO: clear iso_data always when detaching conn from hcon
>     https://git.kernel.org/bluetooth/bluetooth-next/c/e824c0bbe0ec
> 
> You are awesome, thank you!

Was this version of the patch picked accidentally?

This v1 breaks transition to BT_CLOSED state (tested via the new ISO
Connect Linger - Success iso-tester patch), since iso_chan_del() is not
necessarily called

https://lore.kernel.org/linux-bluetooth/[email protected]/

The later versions changed title to "Bluetooth: ISO: fix UAF on socket
close before shutdown completes". Sorry about the unclarity.

***

There's some remaining problems related to ISO socket teardown, present
also in previous bluetooth-next/master versions (don't have patches for
these yet):

1)

iso_sock_kill(sk) has

	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
	    sock_flag(sk, SOCK_DEAD))
		return;

which always returns early, since sk->sk_socket is NULL after
sock_orphan(), but sock_orphan() sets SOCK_DEAD. Looks like
iso_sock_destruct() never runs in iso-tester. (SOCK_DEAD ->
SOCK_DESTROY probably works here, likely should hold lock_sock for the
whole segment).

2)

iso_conn_del() doesn't call sco_sock_kill(), so suspecting that release
of sk in BT_CONNECTED state without preceding shutdown does not free
the socket.

3)

Correctness of iso_conn_del() requires reasoning about "who has the
last reference" with race conditions, which is maybe too complicated,
perhaps it should directly clear iso_conn::hcon

-- 
Pauli Virtanen