Patch "Bluetooth: hci_ldisc: Fix another race when closing the tty." has been added to the 4.14-stable tree

This is a note to let you know that I've just added the patch titled

Bluetooth: hci_ldisc: Fix another race when closing the tty.

to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
bluetooth-hci_ldisc-fix-another-race-when-closing-the-tty.patch
and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Ronald Tschal�r <[email protected]>
Date: Wed, 25 Oct 2017 22:15:19 -0700
Subject: Bluetooth: hci_ldisc: Fix another race when closing the tty.

From: Ronald Tschal�r <[email protected]>

[ Upstream commit 0338b1b393ec7910898e8f7b25b3bf31a7282e16 ]

The following race condition still existed:

P1 P2
cancel_work_sync()
hci_uart_tx_wakeup() hci_uart_write_work() hci_uart_dequeue()
clear_bit(HCI_UART_PROTO_READY) hci_unregister_dev(hdev)
hci_free_dev(hdev)
hu->proto->close(hu)
kfree(hu)
access to hdev and hu

Cancelling the work after clearing the HCI_UART_PROTO_READY bit avoids this as any hci_uart_tx_wakeup() issued after the flag is cleared will detect that and not schedule further work.

---
 drivers/bluetooth/hci_ldisc.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -510,13 +510,13 @@ static void hci_uart_tty_close(struct tt
 	if (hdev)
 		hci_uart_close(hdev);
 
-	cancel_work_sync(&hu->write_work);
-
 	if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) {
 		write_lock_irqsave(&hu->proto_lock, flags);
 		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
 		write_unlock_irqrestore(&hu->proto_lock, flags);
 
+		cancel_work_sync(&hu->write_work);
+
 		if (hdev) {
 			if (test_bit(HCI_UART_REGISTERED, &hu->flags))
 				hci_unregister_dev(hdev);

Patches currently in stable-queue which might be from [email protected] are

queue-4.14/bluetooth-hci_ldisc-fix-another-race-when-closing-the-tty.patch