Commit 812e92b8 authored by Luiz Augusto von Dentz's avatar Luiz Augusto von Dentz
Browse files

Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release 

Due to change to switch to use lock_sock inside rfcomm_sk_state_change
the socket shutdown/release procedure can cause a deadlock:

    rfcomm_sock_shutdown():
      lock_sock();
      __rfcomm_sock_close():
        rfcomm_dlc_close():
          __rfcomm_dlc_close():
            rfcomm_dlc_lock();
            rfcomm_sk_state_change():
              lock_sock();

To fix this when the call __rfcomm_sock_close is now done without
holding the lock_sock since rfcomm_dlc_lock exists to protect
the dlc data there is no need to use lock_sock in that code path.

Link: https://lore.kernel.org/all/CAD+dNTsbuU4w+Y_P7o+VEN7BYCAbZuwZx2+tH+OTzCdcZF82YA@mail.gmail.com/


Fixes: b7ce436a ("Bluetooth: switch to lock_sock in RFCOMM")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 9afc675e

net/bluetooth/rfcomm/sock.c

+3 −0
Original line number Diff line number Diff line
@@ -902,7 +902,10 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how) 
	lock_sock(sk);

	if (!sk->sk_shutdown) {

		sk->sk_shutdown = SHUTDOWN_MASK;



		release_sock(sk);

		__rfcomm_sock_close(sk);

		lock_sock(sk);



		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&

		    !(current->flags & PF_EXITING))