Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER  When protocol sets HCI_PROTO_DEFER, hci_conn_request_evt() calls hci_connect_cfm(conn) without hdev->lock. Generally hci_connect_cfm() assumes it is held, and if conn is deleted concurrently -> UAF.  Only SCO and ISO set HCI_PROTO_DEFER and only for defer setup listen, and HCI_EV_CONN_REQUEST is not generated for ISO.  In the non-deferred listening socket code paths, hci_connect_cfm(conn) is called with hdev->lock held.  Fix by holding the lock.