From 53601bfac38e7303c65b5b46c4791afa94362248 Mon Sep 17 00:00:00 2001
From: Iulia Tanasescu <iulia.tanasescu@nxp.com>
Date: Thu, 13 Mar 2025 13:21:44 +0900
Subject: [PATCH] Bluetooth: iso: Always release hdev at the end of
 iso_listen_bis

BugLink: https://bugs.launchpad.net/bugs/2102181

[ Upstream commit 9c76fff747a73ba01d1d87ed53dd9c00cb40ba05 ]

Since hci_get_route holds the device before returning, the hdev
should be released with hci_dev_put at the end of iso_listen_bis
even if the function returns with an error.

Fixes: 02171da6e86a ("Bluetooth: ISO: Add hcon for listening bis sk")
Signed-off-by: Iulia Tanasescu <iulia.tanasescu@nxp.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
CVE-2024-57879
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Mehmet Basaran <mehmet.basaran@canonical.com>
---
 net/bluetooth/iso.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 31d6d6eea92a..60c546d59dfe 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1158,10 +1158,9 @@ static int iso_listen_bis(struct sock *sk)
 		goto unlock;
 	}
 
-	hci_dev_put(hdev);
-
 unlock:
 	hci_dev_unlock(hdev);
+	hci_dev_put(hdev);
 	return err;
 }