Bluetooth: ISO: lock sk in iso_connect_ind
authorPauli Virtanen <pav@iki.fi>
Fri, 24 Jul 2026 20:20:26 +0000 (23:20 +0300)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Tue, 28 Jul 2026 20:13:11 +0000 (16:13 -0400)
commit4311fd6f429065a8ba208660360a895627a00cf3
treef359924285ca7d9054edf1b844b2863eff443fea
parent89cf154d7c18e6e94a3da83051f3cf2bac317ae2
Bluetooth: ISO: lock sk in iso_connect_ind

Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the
"ev3" part of iso_connect_ind.  It may also be NULL if socket has
transitioned away from the LISTEN/CONNECT states before locking.

Fix by adding lock/release. Recheck hcon is valid after lock acquire
where needed.

Fixes: 168d9bf9c7f0 ("Bluetooth: ISO: Reassemble PA data for bcast sink")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/iso.c