CVE-2021-47038

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: avoid deadlock between hci_dev->lock and socket lock

Commit eab2404ba798 ("Bluetooth: Add BT_PHY socket option") added a

dependency between socket lock and hci_dev->lock that could lead to

deadlock.

It turns out that hci_conn_get_phy() is not in any way relying on hdev

being immutable during the runtime of this function, neither does it even

look at any of the members of hdev, and as such there is no need to hold

that lock.

This fixes the lockdep splat below:

======================================================

WARNING: possible circular locking dependency detected

5.12.0-rc1-00026-g73d464503354 #10 Not tainted

------------------------------------------------------

bluetoothd/1118 is trying to acquire lock:

ffff8f078383c078 (&hdev->lock){+.+.}-{3:3}, at: hci_conn_get_phy+0x1c/0x150 [bluetooth]

but task is already holding lock:

ffff8f07e831d920 (sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP){+.+.}-{0:0},

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References