Hi Myungho, > When releasing socket, it is possible to enter hci_sock_release() and > hci_sock_dev_event(HCI_DEV_UNREG) at the same time in different thread. > The reference count of hdev should be decremented only once from one of > them but if storing hdev to local variable in hci_sock_release() before > detached from socket and setting to NULL in hci_sock_dev_event(), > hci_dev_put(hdev) is unexpectedly called twice. This is resolved by > referencing hdev from socket after bt_sock_unlink() in > hci_sock_release(). > > Reported-by: syzbot+fdc00003f4efff43b...@syzkaller.appspotmail.com > Signed-off-by: Myungho Jung <mhju...@gmail.com> > --- > net/bluetooth/hci_sock.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-)
patch has been applied to bluetooth-next tree. Regards Marcel
