Bluetooth: hci_uart: Cancel init work before unregistering

If hci_uart_tty_close() or hci_uart_unregister_device() is called while
hu->init_ready is scheduled, hci_register_dev() could be called after
the hci_uart is torn down. Avoid this by ensuring the work is complete
or canceled before checking the HCI_UART_REGISTERED flag.

Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 85a30fb9177bbe719666d9e00f63e219f3ef3f49..f83d67eafc9f0e8739dfa6743c086ce3360ee2af 100644 (file)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -538,6 +538,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
                clear_bit(HCI_UART_PROTO_READY, &hu->flags);
                percpu_up_write(&hu->proto_lock);
 
+               cancel_work_sync(&hu->init_ready);
                cancel_work_sync(&hu->write_work);
 
                if (hdev) {

diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
index 7b233312e723fb2b1a7ba94cfc54751d1a28abbb..3977bba485c2278f5627e8c74e56b125ca9e4887 100644 (file)
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -355,6 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
        struct hci_dev *hdev = hu->hdev;
 
        clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+
+       cancel_work_sync(&hu->init_ready);
        if (test_bit(HCI_UART_REGISTERED, &hu->flags))
                hci_unregister_dev(hdev);
        hci_free_dev(hdev);