From: Ian Molton <ian@mnementh.co.uk>
Date: Sat, 8 Jul 2017 13:43:34 +0000 (+0100)
Subject: Bluetooth: hci_nokia: prevent crash on module removal
X-Git-Tag: v4.14-rc1~130^2~405^2~13
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ca2eae7d25a1d3c7c675808fa907188e6a099537;p=platform%2Fkernel%2Flinux-rpi.git

Bluetooth: hci_nokia: prevent crash on module removal

Only cancel any ongoing work after making sure, that no new work
can be scheduled. This fixes a race condition in the remove handler.

Signed-off-by: Ian Molton <ian@mnementh.co.uk>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---

diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
index 181a15b..bc1f449 100644
--- a/drivers/bluetooth/hci_nokia.c
+++ b/drivers/bluetooth/hci_nokia.c
@@ -770,10 +770,12 @@ static void nokia_bluetooth_serdev_remove(struct serdev_device *serdev)
 	struct hci_uart *hu = &btdev->hu;
 	struct hci_dev *hdev = hu->hdev;
 
-	cancel_work_sync(&hu->write_work);
 
 	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
+
+	cancel_work_sync(&hu->write_work);
+
 	hu->proto->close(hu);
 
 	pm_runtime_disable(&btdev->serdev->dev);