[PATCH v5 0/7] Bluetooth: hci_conn: hold conn references in hci_sync tasks

[Pauli Virtanen]

Have hci_sync tasks hold reference to hci_conn pointer they want to use
later.

Avoids UAFs and passing potentially reused (possible even if very
unlikely) pointers to hci_conn_valid().

hci_conn_del() dequeues running works for the same connection, but this
has no effect if the work is already started running, which is the race
condition here.

v5:
- resend
- no need to check hci_conn_valid() in create_big_complete, the bit is
  safe to clear also if hci_conn_del() has run

v4:
- Check !conn in hci_connect_big_sync() first.
  It's probably bug in iso.c that it may call this with NULL, but
  probably better fixed separately.

v3:
- resending some rebased parts from
  https://lore.kernel.org/linux-bluetooth/cover.1762100290.git.pav@xxxxxx/
  https://lore.kernel.org/linux-bluetooth/cover.1758481869.git.pav@xxxxxx/

Pauli Virtanen (7):
  Bluetooth: hci_conn: hold conn reference in abort_conn_sync()
  Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks
  Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback
  Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback
  Bluetooth: hci_sync: hold conn in hci_past_sync() callback
  Bluetooth: hci_sync: fix hci_conn_del() use in hci_le_create_conn_sync
  Bluetooth: hci_sync: remove unnecessary hci_conn_get in
    create_conn_sync

 net/bluetooth/hci_conn.c | 12 +++++-
 net/bluetooth/hci_sync.c | 85 +++++++++++++++++++++++++---------------
 2 files changed, 65 insertions(+), 32 deletions(-)

-- 
2.55.0