Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

syzbot reports a possible deadlock in rfcomm_sk_state_change [1].

While rfcomm_sock_connect acquires the sk lock and waits for

the rfcomm lock, rfcomm_sock_release could have the rfcomm

lock and hit a deadlock for acquiring the sk lock.

Here's a simplified flow:

rfcomm_sock_connect:

lock_sock(sk)

rfcomm_dlc_open:

rfcomm_lock()

rfcomm_sock_release:

rfcomm_sock_shutdown:

rfcomm_lock()

__rfcomm_dlc_close:

rfcomm_k_state_change:

lock_sock(sk)

This patch drops the sk lock before calling rfcomm_dlc_open to

avoid the possible deadlock and holds sk's reference count to

prevent use-after-free after rfcomm_dlc_open completes.