Bluetooth: ISO: Fix UAF on iso_sock_timeout

[ Upstream commit 246b435ad668596aa0e2bbb9d491b6413861211a ]

conn->sk maybe have been unlinked/freed while waiting for iso_conn_lock
so this checks if the conn->sk is still valid by checking if it part of
iso_sk_list.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index b61abddc7bd4e2756829e8d5b50c7d49e878979c..27efca5dc7bbf787b7ef0d8d2f4e1959930888d1 100644 (file)
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -68,6 +68,16 @@ struct iso_pinfo {
 #define ISO_CONN_TIMEOUT       (HZ * 40)
 #define ISO_DISCONN_TIMEOUT    (HZ * 2)
 
+static struct sock *iso_sock_hold(struct iso_conn *conn)
+{
+       if (!conn || !bt_sock_linked(&iso_sk_list, conn->sk))
+               return NULL;
+
+       sock_hold(conn->sk);
+
+       return conn->sk;
+}
+
 static void iso_sock_timeout(struct work_struct *work)
 {
        struct iso_conn *conn = container_of(work, struct iso_conn,
@@ -75,9 +85,7 @@ static void iso_sock_timeout(struct work_struct *work)
        struct sock *sk;
 
        iso_conn_lock(conn);
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = iso_sock_hold(conn);
        iso_conn_unlock(conn);
 
        if (!sk)
@@ -184,9 +192,7 @@ static void iso_conn_del(struct hci_conn *hcon, int err)
 
        /* Kill socket */
        iso_conn_lock(conn);
-       sk = conn->sk;
-       if (sk)
-               sock_hold(sk);
+       sk = iso_sock_hold(conn);
        iso_conn_unlock(conn);
 
        if (sk) {