[PATCH] Bluetooth: btsdio: disable the TX work on removal

[PATCH] Bluetooth: btsdio: disable the TX work on removal

[Myeonghun Pak]

btsdio_remove() cancels data->work before hci_unregister_dev() stops
the HCI command and TX workers. They can still call btsdio_send_frame()
and queue it again, allowing it to run after hci_free_dev() or release
of the devm-allocated driver data.

Use disable_work_sync() to drain the work and reject later queueing.
Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: 73f7b171b7c0 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition")
Cc: stable@vger.kernel.org # v6.10+
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>

---

 drivers/bluetooth/btsdio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index a194fc85abfb..680965e74bcc 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -350,7 +350,7 @@ static void btsdio_remove(struct sdio_func *func)
 	if (!data)
 		return;
 
-	cancel_work_sync(&data->work);
+	disable_work_sync(&data->work);
 	hdev = data->hdev;
 
 	sdio_set_drvdata(func, NULL);

base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.43.0

RE: Bluetooth: btsdio: disable the TX work on removal

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1020 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1206717/

---Test result---

Test Summary:
CheckPatch                    PASS      0.66 seconds
VerifyFixes                   PASS      0.10 seconds
VerifySignedoff               PASS      0.10 seconds
GitLint                       PASS      0.27 seconds
SubjectPrefix                 PASS      0.09 seconds
BuildKernel                   PASS      29.57 seconds
CheckAllWarning               PASS      33.28 seconds
CheckSparse                   PASS      36.01 seconds
BuildKernel32                 PASS      29.34 seconds
CheckKernelLLVM               PASS      32.41 seconds
TestRunnerSetup               PASS      693.33 seconds
IncrementalBuild              PASS      27.35 seconds



https://github.com/bluez/bluetooth-next/pull/1099

---
Regards,
Linux Bluetooth