Patch "Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bluetooth-btusb-mediatek-add-locks-for-usb_driver_cl.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ad7e6ee6c7a3a77f321076f0755b6c4df4694ecd
Author: Douglas Anderson <dianders@xxxxxxxxxxxx>
Date:   Wed Jan 15 19:36:36 2025 -0800

    Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()
    
    [ Upstream commit e9087e828827e5a5c85e124ce77503f2b81c3491 ]
    
    The documentation for usb_driver_claim_interface() says that "the
    device lock" is needed when the function is called from places other
    than probe(). This appears to be the lock for the USB interface
    device. The Mediatek btusb code gets called via this path:
    
      Workqueue: hci0 hci_power_on [bluetooth]
      Call trace:
       usb_driver_claim_interface
       btusb_mtk_claim_iso_intf
       btusb_mtk_setup
       hci_dev_open_sync
       hci_power_on
       process_scheduled_works
       worker_thread
       kthread
    
    With the above call trace the device lock hasn't been claimed. Claim
    it.
    
    Without this fix, we'd sometimes see the error "Failed to claim iso
    interface". Sometimes we'd even see worse errors, like a NULL pointer
    dereference (where `intf->dev.driver` was NULL) with a trace like:
    
      Call trace:
       usb_suspend_both
       usb_runtime_suspend
       __rpm_callback
       rpm_suspend
       pm_runtime_work
       process_scheduled_works
    
    Both errors appear to be fixed with the proper locking.
    
    Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions")
    Signed-off-by: Douglas Anderson <dianders@xxxxxxxxxxxx>
    Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 279fe6c115fac..f69df515d668b 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2638,8 +2638,15 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
 	struct btmtk_data *btmtk_data = hci_get_priv(data->hdev);
 	int err;
 
+	/*
+	 * The function usb_driver_claim_interface() is documented to need
+	 * locks held if it's not called from a probe routine. The code here
+	 * is called from the hci_power_on workqueue, so grab the lock.
+	 */
+	device_lock(&btmtk_data->isopkt_intf->dev);
 	err = usb_driver_claim_interface(&btusb_driver,
 					 btmtk_data->isopkt_intf, data);
+	device_unlock(&btmtk_data->isopkt_intf->dev);
 	if (err < 0) {
 		btmtk_data->isopkt_intf = NULL;
 		bt_dev_err(data->hdev, "Failed to claim iso interface");