Patch "Bluetooth: SCO: fix sco_conn related locking and validity issues" has been added to the 6.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: SCO: fix sco_conn related locking and validity issues

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-sco-fix-sco_conn-related-locking-and-valid.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit cc9d54b74879a34272695218fd49e9ba6687e670
Author: Pauli Virtanen <pav@xxxxxx>
Date:   Mon Jul 10 19:48:19 2023 +0300

    Bluetooth: SCO: fix sco_conn related locking and validity issues
    
    [ Upstream commit 3dcaa192ac2159193bc6ab57bc5369dcb84edd8e ]
    
    Operations that check/update sk_state and access conn should hold
    lock_sock, otherwise they can race.
    
    The order of taking locks is hci_dev_lock > lock_sock > sco_conn_lock,
    which is how it is in connect/disconnect_cfm -> sco_conn_del ->
    sco_chan_del.
    
    Fix locking in sco_connect to take lock_sock around updating sk_state
    and conn.
    
    sco_conn_del must not occur during sco_connect, as it frees the
    sco_conn. Hold hdev->lock longer to prevent that.
    
    sco_conn_add shall return sco_conn with valid hcon. Make it so also when
    reusing an old SCO connection waiting for disconnect timeout (see
    __sco_sock_close where conn->hcon is set to NULL).
    
    This should not reintroduce the issue fixed in the earlier
    commit 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking
    dependency on sco_connect_cfm"), the relevant fix of releasing lock_sock
    in sco_sock_connect before acquiring hdev->lock is retained.
    
    These changes mirror similar fixes earlier in ISO sockets.
    
    Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm")
    Signed-off-by: Pauli Virtanen <pav@xxxxxx>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index cd1a27ac555d0..7762604ddfc05 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -126,8 +126,11 @@ static struct sco_conn *sco_conn_add(struct hci_conn *hcon)
 	struct hci_dev *hdev = hcon->hdev;
 	struct sco_conn *conn = hcon->sco_data;
 
-	if (conn)
+	if (conn) {
+		if (!conn->hcon)
+			conn->hcon = hcon;
 		return conn;
+	}
 
 	conn = kzalloc(sizeof(struct sco_conn), GFP_KERNEL);
 	if (!conn)
@@ -268,21 +271,21 @@ static int sco_connect(struct sock *sk)
 		goto unlock;
 	}
 
-	hci_dev_unlock(hdev);
-	hci_dev_put(hdev);
-
 	conn = sco_conn_add(hcon);
 	if (!conn) {
 		hci_conn_drop(hcon);
-		return -ENOMEM;
+		err = -ENOMEM;
+		goto unlock;
 	}
 
-	err = sco_chan_add(conn, sk, NULL);
-	if (err)
-		return err;
-
 	lock_sock(sk);
 
+	err = sco_chan_add(conn, sk, NULL);
+	if (err) {
+		release_sock(sk);
+		goto unlock;
+	}
+
 	/* Update source addr of the socket */
 	bacpy(&sco_pi(sk)->src, &hcon->src);
 
@@ -296,8 +299,6 @@ static int sco_connect(struct sock *sk)
 
 	release_sock(sk);
 
-	return err;
-
 unlock:
 	hci_dev_unlock(hdev);
 	hci_dev_put(hdev);