[PATCH] Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[PATCH] Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[Aldo Ariel Panzardo]

hci_conn_link() takes a lifetime reference to its parent with
hci_conn_get(), but only takes an operational hold on the child.
hci_conn_unlink() later balances both a hold and a reference on the
parent.

The SCO and CIS paths pass a parent acquired from a connect helper, so
it already has a hold. For an additional BIS, hci_bind_bis() obtains the
parent from hci_conn_hash_lookup_big(), which returns a bare pointer.
Unlinking the child then drops the parent's existing hold and can
schedule it for disconnection while its socket is still using it.

Take a hold on the parent before linking it and drop that hold if linking
fails. A successful link transfers the hold to hci_conn_unlink().

Fixes: fa224d0c094a ("Bluetooth: ISO: Reassociate a socket with an active BIS")
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
---
 net/bluetooth/hci_conn.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index b1f911fd4..09a6e0240 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -2342,10 +2342,13 @@ struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
 	parent = hci_conn_hash_lookup_big(hdev,
 					  conn->iso_qos.bcast.big);
 	if (parent && parent != conn) {
+		hci_conn_hold(parent);
 		link = hci_conn_link(parent, conn);
 		hci_conn_drop(conn);
-		if (!link)
+		if (!link) {
+			hci_conn_drop(parent);
 			return ERR_PTR(-ENOLINK);
+		}
 	}
 
 	return conn;
-- 
2.43.0

Re: [PATCH] Bluetooth: ISO: balance the parent hold in hci_bind_bis()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Tue, 15 Sep 2026 13:03:32 -0300 you wrote:
> hci_conn_link() takes a lifetime reference to its parent with
> hci_conn_get(), but only takes an operational hold on the child.
> hci_conn_unlink() later balances both a hold and a reference on the
> parent.
> 
> The SCO and CIS paths pass a parent acquired from a connect helper, so
> it already has a hold. For an additional BIS, hci_bind_bis() obtains the
> parent from hci_conn_hash_lookup_big(), which returns a bare pointer.
> Unlinking the child then drops the parent's existing hold and can
> schedule it for disconnection while its socket is still using it.
> 
> [...]

Here is the summary with links:
  - Bluetooth: ISO: balance the parent hold in hci_bind_bis()
    https://git.kernel.org/bluetooth/bluetooth-next/c/4c94557dd025

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html