Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\))
Subject: Re: [PATCH] Bluetooth: Fix decrementing reference count twice in
 releasing socket
From:   Marcel Holtmann <marcel@holtmann.org>
In-Reply-To: <20190203005634.GA19908@myunghoj-Precision-5530>
Date:   Mon, 4 Feb 2019 15:53:16 +0100
Cc:     Johan Hedberg <johan.hedberg@gmail.com>,
        "David S. Miller" <davem@davemloft.net>,
        linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Content-Transfer-Encoding: 7bit
Message-Id: <131B7D29-1085-4DDC-8DC9-A2ABE533BEC4@holtmann.org>
References: <20190203005634.GA19908@myunghoj-Precision-5530>
To:     Myungho Jung <mhjungk@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Myungho,

> When releasing socket, it is possible to enter hci_sock_release() and
> hci_sock_dev_event(HCI_DEV_UNREG) at the same time in different thread.
> The reference count of hdev should be decremented only once from one of
> them but if storing hdev to local variable in hci_sock_release() before
> detached from socket and setting to NULL in hci_sock_dev_event(),
> hci_dev_put(hdev) is unexpectedly called twice. This is resolved by
> referencing hdev from socket after bt_sock_unlink() in
> hci_sock_release().
> 
> Reported-by: syzbot+fdc00003f4efff43bc5b@syzkaller.appspotmail.com
> Signed-off-by: Myungho Jung <mhjungk@gmail.com>
> ---
> net/bluetooth/hci_sock.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel