From: Jiri Slaby Date: Fri, 13 May 2016 08:38:49 +0000 (+0200) Subject: Bluetooth: fix power_on vs close race X-Git-Tag: v4.14-rc1~3245^2~33^2~1 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=bf389cabb3b8079c23f9762e62b05f291e2d5e99;p=platform%2Fkernel%2Flinux-rpi.git Bluetooth: fix power_on vs close race With all the latest fixes applied, I am still able to reproduce this (and other) warning(s): WARNING: CPU: 1 PID: 19684 at ../kernel/workqueue.c:4092 destroy_workqueue+0x70a/0x770() ... Call Trace: [] ? dump_stack+0xb3/0x112 [] ? warn_slowpath_common+0xde/0x140 [] ? destroy_workqueue+0x70a/0x770 [] ? warn_slowpath_null+0x2e/0x40 [] ? destroy_workqueue+0x70a/0x770 [] ? hci_unregister_dev+0x2a9/0x720 [bluetooth] [] ? vhci_release+0x7b/0xf0 [hci_vhci] [] ? vhci_flush+0x50/0x50 [hci_vhci] [] ? do_exit+0x863/0x2b90 This is due to race present in the hci_unregister_dev path. hdev->power_on work races with hci_dev_do_close. One tries to open, the other tries to close, leading to warning like the above. (Another example is a warning in kobject_get or kobject_put depending on who wins the race.) Fix this by switching those two racers to ensure hdev->power_on never triggers while hci_dev_do_close is in progress. Signed-off-by: Jiri Slaby Signed-off-by: Marcel Holtmann --- diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index 2713fc8..45a9fc6 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3139,10 +3139,10 @@ void hci_unregister_dev(struct hci_dev *hdev) list_del(&hdev->list); write_unlock(&hci_dev_list_lock); - hci_dev_do_close(hdev); - cancel_work_sync(&hdev->power_on); + hci_dev_do_close(hdev); + if (!test_bit(HCI_INIT, &hdev->flags) && !hci_dev_test_flag(hdev, HCI_SETUP) && !hci_dev_test_flag(hdev, HCI_CONFIG)) {