• Claire Chang's avatar
    Bluetooth: hci_uart: Fix a race for write_work scheduling · afe0b1c8
    Claire Chang authored
    In hci_uart_write_work, there is a loop/goto checking the value of
    HCI_UART_TX_WAKEUP. If HCI_UART_TX_WAKEUP is set again, it keeps trying
    hci_uart_dequeue; otherwise, it clears HCI_UART_SENDING and returns.
    
    In hci_uart_tx_wakeup, if HCI_UART_SENDING is already set, it sets
    HCI_UART_TX_WAKEUP, skips schedule_work and assumes the running/pending
    hci_uart_write_work worker will do hci_uart_dequeue properly.
    
    However, if the HCI_UART_SENDING check in hci_uart_tx_wakeup is done after
    the loop breaks, but before HCI_UART_SENDING is cleared in
    hci_uart_write_work, the schedule_work is skipped incorrectly.
    
    Fix this race by changing the order of HCI_UART_SENDING and
    HCI_UART_TX_WAKEUP modification.
    
    Fixes: 1da177e4 ("Linux-2.6.12-rc2")
    Fixes: 82f5169b ("Bluetooth: hci_uart: add serdev driver support library")
    Signed-off-by: default avatarClaire Chang <tientzu@chromium.org>
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    afe0b1c8
hci_serdev.c 8.8 KB