Revert "Bluetooth: af_bluetooth: Fix deadlock"

This reverts commit cb8adca52f306563d958a863bb0cbae9c184d1ae which is
commit f7b94bdc1ec107c92262716b073b3e816d4784fb upstream.

It is reported to cause regressions in the 6.1.y tree, so revert it for
now.

Link: https://lore.kernel.org/all/CADRbXaDqx6S+7tzdDPPEpRu9eDLrHQkqoWTTGfKJSRxY=hT5MQ@mail.gmail.com/
Reported-by: Jeremy Lainé <jeremy.laine@m4x.org>
Cc: Salvatore Bonaccorso <carnil@debian.org>
Cc: Mike <user.service2016@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: Paul Menzel <pmenzel@molgen.mpg.de>
Cc: Pauli Virtanen <pav@iki.fi>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 4c3bd051603872c4b82818899a29b0040f6f14ec..7960fd514e5a8010bf946f5c0d67bf667d57b878 100644 (file)
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -307,11 +307,14 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
        if (flags & MSG_OOB)
                return -EOPNOTSUPP;
 
+       lock_sock(sk);
+
        skb = skb_recv_datagram(sk, flags, &err);
        if (!skb) {
                if (sk->sk_shutdown & RCV_SHUTDOWN)
                        err = 0;
 
+               release_sock(sk);
                return err;
        }
 
@@ -337,6 +340,8 @@ int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 
        skb_free_datagram(sk, skb);
 
+       release_sock(sk);
+
        if (flags & MSG_TRUNC)
                copied = skblen;
 
@@ -559,11 +564,10 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                if (sk->sk_state == BT_LISTEN)
                        return -EINVAL;
 
-               spin_lock(&sk->sk_receive_queue.lock);
+               lock_sock(sk);
                skb = skb_peek(&sk->sk_receive_queue);
                amount = skb ? skb->len : 0;
-               spin_unlock(&sk->sk_receive_queue.lock);
-
+               release_sock(sk);
                err = put_user(amount, (int __user *)arg);
                break;