CVE-2023-53016

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix possible deadlock in rfcommskstate_change

syzbot reports a possible deadlock in rfcommskstatechange [1]. While rfcommsockconnect acquires the sk lock and waits for the rfcomm lock, rfcommsock_release could have the rfcomm lock and hit a deadlock for acquiring the sk lock. Here's a simplified flow:

rfcommsockconnect: locksock(sk) rfcommdlcopen: rfcommlock()

rfcommsockrelease: rfcommsockshutdown: rfcomm_lock() __rfcommdlcclose: rfcommkstatechange: locksock(sk)

This patch drops the sk lock before calling rfcommdlcopen to avoid the possible deadlock and holds sk's reference count to prevent use-after-free after rfcommdlcopen completes.