[PATCH] Bluetooth: L2CAP: avoid deadlock with process_pending_rx

[Oliver Neukum <oneukum@suse.com>]

The fix for the deadlock caused by cancelling works taking a lock
while holding the same lock in l2cap_conn_del()
shifted the cancellation of info_timer and id_addr_timer to a time
before taking the lock. However, it left cancelling
pending_rx_work() inside the scope of the lock. process_pending_rx(),
however, also takes the lock. It can deadlock.
Shift the cancellation to before the lock, too.

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: ab4eedb790cae ("Bluetooth: L2CAP: Fix corrupted list in hci_chan_del")
---
 net/bluetooth/l2cap_core.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 62133eef9d2f..4b144eefdd33 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1772,8 +1772,14 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 
+	/*
+	 * these take conn->lock
+	 * Hence a synchronous cancellation
+	 * would deadlock if done with the lock held
+	 */
 	disable_delayed_work_sync(&conn->info_timer);
 	disable_delayed_work_sync(&conn->id_addr_timer);
+	disable_work_sync(&conn->pending_rx_work);
 
 	mutex_lock(&conn->lock);
 
@@ -1781,13 +1787,6 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
 
 	skb_queue_purge(&conn->pending_rx);
 
-	/* We can not call flush_work(&conn->pending_rx_work) here since we
-	 * might block if we are running on a worker from the same workqueue
-	 * pending_rx_work is waiting on.
-	 */
-	if (work_pending(&conn->pending_rx_work))
-		cancel_work_sync(&conn->pending_rx_work);
-
 	ida_destroy(&conn->tx_ida);
 
 	l2cap_unregister_all_users(conn);
-- 
2.54.0