For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
Author: jcperdomo100@gmail.com

#syz test

rfcomm_sock_cleanup_listen() closes unaccepted child sockets through
rfcomm_sock_close(), which takes the RFCOMM socket lock before
rfcomm_dlc_close() acquires rfcomm_mutex.

The RFCOMM worker takes these locks in reverse order: it holds
rfcomm_mutex while rfcomm_connect_ind() or a DLC state callback acquires
an RFCOMM socket lock. Lockdep therefore reports a possible deadlock.

Remove the redundant socket locking from rfcomm_sock_close(). Its only
caller receives the dequeued child with a reference held, and the
function is already documented as requiring an unlocked socket. This
also matches rfcomm_sock_shutdown(), which drops the socket lock before
closing the DLC.

Reported-by: syzbot+0cece8fa7d83523f47a3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0cece8fa7d83523f47a3
Fixes: b7ce436a5d79 ("Bluetooth: switch to lock_sock in RFCOMM")
Signed-off-by: Juan Perdomo <jcperdomo100@gmail.com>
---
 net/bluetooth/rfcomm/sock.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 958081adb..1a35fb5fd 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -242,9 +242,7 @@ static void __rfcomm_sock_close(struct sock *sk)
  */
 static void rfcomm_sock_close(struct sock *sk)
 {
-	lock_sock(sk);
 	__rfcomm_sock_close(sk);
-	release_sock(sk);
 }
 
 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
-- 
2.50.1 (Apple Git-155)