Patch "Bluetooth: hci_uart: Fix a race for write_work scheduling" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: hci_uart: Fix a race for write_work scheduling

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-hci_uart-fix-a-race-for-write_work-schedul.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 18be0b28464f4fed8f96c7c53c85865567cd0d16
Author: Claire Chang <tientzu@xxxxxxxxxxxx>
Date:   Mon Dec 14 15:29:21 2020 +0800

    Bluetooth: hci_uart: Fix a race for write_work scheduling
    
    [ Upstream commit afe0b1c86458f121b085271e4f3034017a90d4a3 ]
    
    In hci_uart_write_work, there is a loop/goto checking the value of
    HCI_UART_TX_WAKEUP. If HCI_UART_TX_WAKEUP is set again, it keeps trying
    hci_uart_dequeue; otherwise, it clears HCI_UART_SENDING and returns.
    
    In hci_uart_tx_wakeup, if HCI_UART_SENDING is already set, it sets
    HCI_UART_TX_WAKEUP, skips schedule_work and assumes the running/pending
    hci_uart_write_work worker will do hci_uart_dequeue properly.
    
    However, if the HCI_UART_SENDING check in hci_uart_tx_wakeup is done after
    the loop breaks, but before HCI_UART_SENDING is cleared in
    hci_uart_write_work, the schedule_work is skipped incorrectly.
    
    Fix this race by changing the order of HCI_UART_SENDING and
    HCI_UART_TX_WAKEUP modification.
    
    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Fixes: 82f5169bf3d3 ("Bluetooth: hci_uart: add serdev driver support library")
    Signed-off-by: Claire Chang <tientzu@xxxxxxxxxxxx>
    Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index f83d67eafc9f0..8be4d807d1370 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -127,10 +127,9 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
 	if (!test_bit(HCI_UART_PROTO_READY, &hu->flags))
 		goto no_schedule;
 
-	if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
-		set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+	set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+	if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state))
 		goto no_schedule;
-	}
 
 	BT_DBG("");
 
@@ -174,10 +173,10 @@ static void hci_uart_write_work(struct work_struct *work)
 		kfree_skb(skb);
 	}
 
+	clear_bit(HCI_UART_SENDING, &hu->tx_state);
 	if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
 		goto restart;
 
-	clear_bit(HCI_UART_SENDING, &hu->tx_state);
 	wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
 }
 
diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
index 5b9aa73ff2b7f..1b4ad231e6ed3 100644
--- a/drivers/bluetooth/hci_serdev.c
+++ b/drivers/bluetooth/hci_serdev.c
@@ -85,9 +85,9 @@ static void hci_uart_write_work(struct work_struct *work)
 			hci_uart_tx_complete(hu, hci_skb_pkt_type(skb));
 			kfree_skb(skb);
 		}
-	} while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
 
-	clear_bit(HCI_UART_SENDING, &hu->tx_state);
+		clear_bit(HCI_UART_SENDING, &hu->tx_state);
+	} while (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state));
 }
 
 /* ------- Interface to HCI layer ------ */