queue-4.14/bluetooth-fix-decrementing-reference-count-twice-in-releasing-socket.patch

   1 From e20a2e9c42c9e4002d9e338d74e7819e88d77162 Mon Sep 17 00:00:00 2001
   2 From: Myungho Jung <mhjungk@gmail.com>
   3 Date: Sat, 2 Feb 2019 16:56:36 -0800
   4 Subject: Bluetooth: Fix decrementing reference count twice in releasing socket
   5
   6 From: Myungho Jung <mhjungk@gmail.com>
   7
   8 commit e20a2e9c42c9e4002d9e338d74e7819e88d77162 upstream.
   9
  10 When releasing socket, it is possible to enter hci_sock_release() and
  11 hci_sock_dev_event(HCI_DEV_UNREG) at the same time in different thread.
  12 The reference count of hdev should be decremented only once from one of
  13 them but if storing hdev to local variable in hci_sock_release() before
  14 detached from socket and setting to NULL in hci_sock_dev_event(),
  15 hci_dev_put(hdev) is unexpectedly called twice. This is resolved by
  16 referencing hdev from socket after bt_sock_unlink() in
  17 hci_sock_release().
  18
  19 Reported-by: syzbot+fdc00003f4efff43bc5b@syzkaller.appspotmail.com
  20 Signed-off-by: Myungho Jung <mhjungk@gmail.com>
  21 Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  net/bluetooth/hci_sock.c |    3 +--
  26  1 file changed, 1 insertion(+), 2 deletions(-)
  27
  28 --- a/net/bluetooth/hci_sock.c
  29 +++ b/net/bluetooth/hci_sock.c
  30 @@ -826,8 +826,6 @@ static int hci_sock_release(struct socke
  31         if (!sk)
  32                 return 0;
  33
  34 -       hdev = hci_pi(sk)->hdev;
  35 -
  36         switch (hci_pi(sk)->channel) {
  37         case HCI_CHANNEL_MONITOR:
  38                 atomic_dec(&monitor_promisc);
  39 @@ -849,6 +847,7 @@ static int hci_sock_release(struct socke
  40
  41         bt_sock_unlink(&hci_sk_list, sk);
  42
  43 +       hdev = hci_pi(sk)->hdev;
  44         if (hdev) {
  45                 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
  46                         /* When releasing a user channel exclusive access,