[Bluetooth] Fix rfcomm_sock_destruct() deadlock

The fix for socket unlink race introduced a deadlock in the RFCOMM
code. The state change function is always called under the DLC lock
and if rfcomm_sock_kill() is called the rfcomm_sock_destruct() will
dead lock. So the DLC lock must be dropped first and claimed again
afterwards.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

net/bluetooth/rfcomm/sock.c

@@ -117,8 +117,13 @@ static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
 
 	bh_unlock_sock(sk);
 
-	if (parent && sk->sk_zapped)
+	if (parent && sk->sk_zapped) {
+		/* We have to drop DLC lock here, otherwise
+		 * rfcomm_sock_destruct() will dead lock. */
+		rfcomm_dlc_unlock(d);
 		rfcomm_sock_kill(sk);
+		rfcomm_dlc_lock(d);
+	}
 }
 
 /* ---- Socket functions ---- */