Patch "Bluetooth: hci_uart: Cancel init work before unregistering" has been added to the 5.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: hci_uart: Cancel init work before unregistering

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-hci_uart-cancel-init-work-before-unregiste.patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a5c2765202d7e1ed0e5454a0d32654adab780cac
Author: Samuel Holland <samuel@xxxxxxxxxxxx>
Date:   Sat Aug 1 11:29:56 2020 -0500

    Bluetooth: hci_uart: Cancel init work before unregistering
    
    [ Upstream commit 3b799254cf6f481460719023d7a18f46651e5e7f ]
    
    If hci_uart_tty_close() or hci_uart_unregister_device() is called while
    hu->init_ready is scheduled, hci_register_dev() could be called after
    the hci_uart is torn down. Avoid this by ensuring the work is complete
    or canceled before checking the HCI_UART_REGISTERED flag.
    
    Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers")
    Signed-off-by: Samuel Holland <samuel@xxxxxxxxxxxx>
    Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 85a30fb9177bb..f83d67eafc9f0 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -538,6 +538,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
 		percpu_up_write(&hu->proto_lock);
 
+		cancel_work_sync(&hu->init_ready);
 		cancel_work_sync(&hu->write_work);
 
 		if (hdev) {
diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
index 7b233312e723f..3977bba485c22 100644
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -355,6 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
 	struct hci_dev *hdev = hu->hdev;
 
 	clear_bit(HCI_UART_PROTO_READY, &hu->flags);
+
+	cancel_work_sync(&hu->init_ready);
 	if (test_bit(HCI_UART_REGISTERED, &hu->flags))
 		hci_unregister_dev(hdev);
 	hci_free_dev(hdev);