Patch "Bluetooth: ISO: Fix invalid context error" has been added to the 6.5-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: ISO: Fix invalid context error

to the 6.5-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-iso-fix-invalid-context-error.patch
and it can be found in the queue-6.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 65ecc0e066f4e0d2dc0d4c22f6bb07ba3b47f9d4
Author: Iulia Tanasescu <iulia.tanasescu@xxxxxxx>
Date:   Thu Sep 28 10:52:57 2023 +0300

    Bluetooth: ISO: Fix invalid context error
    
    [ Upstream commit acab8ff29a2a226409cfe04e6d2e0896928c1b3a ]
    
    This moves the hci_le_terminate_big_sync call from rx_work
    to cmd_sync_work, to avoid calling sleeping function from
    an invalid context.
    
    Reported-by: syzbot+c715e1bd8dfbcb1ab176@xxxxxxxxxxxxxxxxxxxxxxxxx
    Fixes: a0bfde167b50 ("Bluetooth: ISO: Add support for connecting multiple BISes")
    Signed-off-by: Iulia Tanasescu <iulia.tanasescu@xxxxxxx>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d331027363313..9d8aa6ad23dc2 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -6978,6 +6978,14 @@ static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
 	hci_dev_unlock(hdev);
 }
 
+static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
+{
+	u8 handle = PTR_UINT(data);
+
+	return hci_le_terminate_big_sync(hdev, handle,
+					 HCI_ERROR_LOCAL_HOST_TERM);
+}
+
 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
 					   struct sk_buff *skb)
 {
@@ -7022,16 +7030,17 @@ static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
 		rcu_read_lock();
 	}
 
+	rcu_read_unlock();
+
 	if (!ev->status && !i)
 		/* If no BISes have been connected for the BIG,
 		 * terminate. This is in case all bound connections
 		 * have been closed before the BIG creation
 		 * has completed.
 		 */
-		hci_le_terminate_big_sync(hdev, ev->handle,
-					  HCI_ERROR_LOCAL_HOST_TERM);
+		hci_cmd_sync_queue(hdev, hci_iso_term_big_sync,
+				   UINT_PTR(ev->handle), NULL);
 
-	rcu_read_unlock();
 	hci_dev_unlock(hdev);
 }