Commit 3b799254 authored Aug 01, 2020 by Samuel Holland Committed by Marcel Holtmann Aug 02, 2020

Bluetooth: hci_uart: Cancel init work before unregistering

If hci_uart_tty_close() or hci_uart_unregister_device() is called while
hu->init_ready is scheduled, hci_register_dev() could be called after
the hci_uart is torn down. Avoid this by ensuring the work is complete
or canceled before checking the HCI_UART_REGISTERED flag.

Fixes: 9f2aee84 ("Bluetooth: Add delayed init sequence support for UART controllers")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

parent b5f628a2

drivers/bluetooth/hci_ldisc.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -538,6 +538,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
		percpu_up_write(&hu->proto_lock);

		cancel_work_sync(&hu->init_ready);
		cancel_work_sync(&hu->write_work);

		if (hdev) {

drivers/bluetooth/hci_serdev.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -355,6 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
		struct hci_dev *hdev = hu->hdev;

		clear_bit(HCI_UART_PROTO_READY, &hu->flags);

		cancel_work_sync(&hu->init_ready);
		if (test_bit(HCI_UART_REGISTERED, &hu->flags))
		hci_unregister_dev(hdev);
		hci_free_dev(hdev);