Pauli Virtanen af24e338bf Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero ... hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data. Fixes: dc26097bdb ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen <pav@iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>		2026-07-28 16:13:12 -04:00
..
bluetooth.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
coredump.h	Bluetooth: Add support for hci devcoredump	2023-04-23 21:57:59 -07:00
hci_core.h	Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero	2026-07-28 16:13:12 -04:00
hci_drv.h	Bluetooth: Annotate struct hci_drv_rp_read_info with __counted_by_le()	2025-09-27 11:37:00 -04:00
hci_mon.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
hci_sock.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
hci_sync.h	Bluetooth: L2CAP: Add support for setting BT_PHY	2026-01-29 13:25:34 -05:00
hci.h	Bluetooth: ISO: exclude RFU bits from ISO_SDU_Length	2026-07-06 10:46:58 -04:00
iso.h	Bluetooth: ISO: Add broadcast support	2022-07-22 17:14:13 -07:00
l2cap.h	Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()	2026-07-06 10:46:58 -04:00
mgmt.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00
rfcomm.h	Bluetooth: RFCOMM: Fix session UAF in set_termios	2026-07-20 17:41:07 -04:00
sco.h	Bluetooth: Add SPDX id lines to some source files	2026-06-11 14:24:41 -04:00