This is a note to let you know that I've just added the patch titled
Bluetooth: hci_ldisc: Fix another race when closing the tty.
to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: bluetooth-hci_ldisc-fix-another-race-when-closing-the-tty.patch and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From foo@baz Mon Dec 18 13:28:59 CET 2017
From: Ronald Tschalär ronald@innovation.ch Date: Wed, 25 Oct 2017 22:15:19 -0700 Subject: Bluetooth: hci_ldisc: Fix another race when closing the tty.
From: Ronald Tschalär ronald@innovation.ch
[ Upstream commit 0338b1b393ec7910898e8f7b25b3bf31a7282e16 ]
The following race condition still existed:
P1 P2 cancel_work_sync() hci_uart_tx_wakeup() hci_uart_write_work() hci_uart_dequeue() clear_bit(HCI_UART_PROTO_READY) hci_unregister_dev(hdev) hci_free_dev(hdev) hu->proto->close(hu) kfree(hu) access to hdev and hu
Cancelling the work after clearing the HCI_UART_PROTO_READY bit avoids this as any hci_uart_tx_wakeup() issued after the flag is cleared will detect that and not schedule further work.
Signed-off-by: Ronald Tschalär ronald@innovation.ch Reviewed-by: Lukas Wunner lukas@wunner.de Signed-off-by: Marcel Holtmann marcel@holtmann.org Signed-off-by: Sasha Levin alexander.levin@verizon.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/bluetooth/hci_ldisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -510,13 +510,13 @@ static void hci_uart_tty_close(struct tt if (hdev) hci_uart_close(hdev);
- cancel_work_sync(&hu->write_work); - if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) { write_lock_irqsave(&hu->proto_lock, flags); clear_bit(HCI_UART_PROTO_READY, &hu->flags); write_unlock_irqrestore(&hu->proto_lock, flags);
+ cancel_work_sync(&hu->write_work); + if (hdev) { if (test_bit(HCI_UART_REGISTERED, &hu->flags)) hci_unregister_dev(hdev);
Patches currently in stable-queue which might be from ronald@innovation.ch are
queue-4.14/bluetooth-hci_ldisc-fix-another-race-when-closing-the-tty.patch