Bluetooth: hci_uart: Fix a race for write_work scheduling
authorClaire Chang <tientzu@chromium.org>
Mon, 14 Dec 2020 07:29:21 +0000 (15:29 +0800)
committerMarcel Holtmann <marcel@holtmann.org>
Fri, 18 Dec 2020 21:25:30 +0000 (22:25 +0100)
commitafe0b1c86458f121b085271e4f3034017a90d4a3
treebae859cd58fa412d934a0d5b8571984ec25e65f4
parentc0187b0bd3e94c48050687d87b2c3c9fbae98ae9
Bluetooth: hci_uart: Fix a race for write_work scheduling

In hci_uart_write_work, there is a loop/goto checking the value of
HCI_UART_TX_WAKEUP. If HCI_UART_TX_WAKEUP is set again, it keeps trying
hci_uart_dequeue; otherwise, it clears HCI_UART_SENDING and returns.

In hci_uart_tx_wakeup, if HCI_UART_SENDING is already set, it sets
HCI_UART_TX_WAKEUP, skips schedule_work and assumes the running/pending
hci_uart_write_work worker will do hci_uart_dequeue properly.

However, if the HCI_UART_SENDING check in hci_uart_tx_wakeup is done after
the loop breaks, but before HCI_UART_SENDING is cleared in
hci_uart_write_work, the schedule_work is skipped incorrectly.

Fix this race by changing the order of HCI_UART_SENDING and
HCI_UART_TX_WAKEUP modification.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 82f5169bf3d3 ("Bluetooth: hci_uart: add serdev driver support library")
Signed-off-by: Claire Chang <tientzu@chromium.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
drivers/bluetooth/hci_ldisc.c
drivers/bluetooth/hci_serdev.c