From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB19830E0D3; Sat, 7 Feb 2026 15:43:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770478989; cv=none; b=f7XLfzKbeapmBTirp/LZwD/GXIjQ+KbENGRM2X/qVzx1V8GQnkPLqihoRr/Y5ciil4bLsuXCF6/6cP6WR7iUgPuowJPQJ8YQ3kjokdLPo3fUlIQ5nTgqz23rrPUjrm8j1KdI/Y3S11sy9tNN05y9KiGabc9DjFMvIxrKfCA+Z+c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770478989; c=relaxed/simple; bh=EVuY8YxnCbt/M/T0k6v7c0qm3qZsbit6FCAOCLNDz5s=; h=Subject:To:Cc:From:Date:In-Reply-To:Message-ID:MIME-Version: Content-Type; b=oAEJV3a20G2XuRshpX69NSiFgcr2hHzqUfeN0UkAy8jveZvJ+TamdTctiH0nNL+Xte8ghoCyWOAEzIM7tEhIGB3VknFrm3hMJJ2HuCnI2QaGZuPdnDwqmxnJ9LAJWho8WZ2vqScpY9R8tX5xW47smkT8Z/QDMOU4XCzjZUccO5g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DdC2xUPM; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DdC2xUPM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4F14BC116D0; Sat, 7 Feb 2026 15:43:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1770478989; bh=EVuY8YxnCbt/M/T0k6v7c0qm3qZsbit6FCAOCLNDz5s=; h=Subject:To:Cc:From:Date:In-Reply-To:From; b=DdC2xUPMvfSQQx/WKgtYSpETvxo+fAKs7wQR7v5Lr9A+98gJAKQP550QbXh/eRf+R 9GyVRIuKwFjiPsPwHebuDtBxdte2GYgC79wHoGNC8jlhtxtb52lnFGzoFbAcH9eCHM 6ZqC7yvWjZiyncXok+8TlP7252inUyh5e9qStINw= Subject: Patch "Bluetooth: hci_qca: Fix the teardown problem for real" has been added to the 5.15-stable tree To: Julia.Lawall@inria.fr,aha310510@gmail.com,akpm@linux-foundation.org,anna-maria@linutronix.de,arnd@arndb.de,gregkh@linuxfoundation.org,jacob.e.keller@intel.com,linux-staging@lists.linux.dev,linux@roeck-us.net,luiz.dentz@gmail.com,marcel@holtmann.org,maz@kernel.org,peterz@infradead.org,rostedt@goodmis.org,sboyd@kernel.org,tglx@linutronix.de,viresh.kumar@linaro.org Cc: From: Date: Sat, 07 Feb 2026 16:43:00 +0100 In-Reply-To: <20251128160539.358938-15-aha310510@gmail.com> Message-ID: <2026020700-bully-lego-19a7@gregkh> Precedence: bulk X-Mailing-List: linux-staging@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit X-stable: commit X-Patchwork-Hint: ignore This is a note to let you know that I've just added the patch titled Bluetooth: hci_qca: Fix the teardown problem for real to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: bluetooth-hci_qca-fix-the-teardown-problem-for-real.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >From aha310510@gmail.com Fri Nov 28 17:07:07 2025 From: Jeongjun Park Date: Sat, 29 Nov 2025 01:05:39 +0900 Subject: Bluetooth: hci_qca: Fix the teardown problem for real To: stable@vger.kernel.org Cc: gregkh@linuxfoundation.org, tglx@linutronix.de, Julia.Lawall@inria.fr, akpm@linux-foundation.org, anna-maria@linutronix.de, arnd@arndb.de, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, linux@roeck-us.net, luiz.dentz@gmail.com, marcel@holtmann.org, maz@kernel.org, peterz@infradead.org, rostedt@goodmis.org, sboyd@kernel.org, viresh.kumar@linaro.org, aha310510@gmail.com, linux-staging@lists.linux.dev, Jacob Keller Message-ID: <20251128160539.358938-15-aha310510@gmail.com> From: Thomas Gleixner [ Upstream commit e0d3da982c96aeddc1bbf1cf9469dbb9ebdca657 ] While discussing solutions for the teardown problem which results from circular dependencies between timers and workqueues, where timers schedule work from their timer callback and workqueues arm the timers from work items, it was discovered that the recent fix to the QCA code is incorrect. That commit fixes the obvious problem of using del_timer() instead of del_timer_sync() and reorders the teardown calls to destroy_workqueue(wq); del_timer_sync(t); This makes it less likely to explode, but it's still broken: destroy_workqueue(wq); /* After this point @wq cannot be touched anymore */ ---> timer expires queue_work(wq) <---- Results in a NULL pointer dereference deep in the work queue core code. del_timer_sync(t); Use the new timer_shutdown_sync() function to ensure that the timers are disarmed, no timer callbacks are running and the timers cannot be armed again. This restores the original teardown sequence: timer_shutdown_sync(t); destroy_workqueue(wq); which is now correct because the timer core silently ignores potential rearming attempts which can happen when destroy_workqueue() drains pending work before mopping up the workqueue. Fixes: 72ef98445aca ("Bluetooth: hci_qca: Use del_timer_sync() before freeing") Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: Jacob Keller Reviewed-by: Anna-Maria Behnsen Acked-by: Luiz Augusto von Dentz Link: https://lore.kernel.org/all/87iljhsftt.ffs@tglx Link: https://lore.kernel.org/r/20221123201625.435907114@linutronix.de Signed-off-by: Jeongjun Park Signed-off-by: Greg Kroah-Hartman --- drivers/bluetooth/hci_qca.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/drivers/bluetooth/hci_qca.c +++ b/drivers/bluetooth/hci_qca.c @@ -709,9 +709,15 @@ static int qca_close(struct hci_uart *hu skb_queue_purge(&qca->tx_wait_q); skb_queue_purge(&qca->txq); skb_queue_purge(&qca->rx_memdump_q); + /* + * Shut the timers down so they can't be rearmed when + * destroy_workqueue() drains pending work which in turn might try + * to arm a timer. After shutdown rearm attempts are silently + * ignored by the timer core code. + */ + timer_shutdown_sync(&qca->tx_idle_timer); + timer_shutdown_sync(&qca->wake_retrans_timer); destroy_workqueue(qca->workqueue); - del_timer_sync(&qca->tx_idle_timer); - del_timer_sync(&qca->wake_retrans_timer); qca->hu = NULL; kfree_skb(qca->rx_skb); Patches currently in stable-queue which might be from aha310510@gmail.com are queue-5.15/timers-update-the-documentation-to-reflect-on-the-new-timer_shutdown-api.patch queue-5.15/clocksource-drivers-arm_arch_timer-do-not-use-timer-namespace-for-timer_shutdown-function.patch queue-5.15/timers-split-del_timer-to-prepare-for-shutdown-mode.patch queue-5.15/arm-spear-do-not-use-timer-namespace-for-timer_shutdown-function.patch queue-5.15/timers-add-shutdown-mechanism-to-the-internal-functions.patch queue-5.15/timers-provide-timer_shutdown.patch queue-5.15/timers-rename-del_timer-to-timer_delete.patch queue-5.15/timers-replace-bug_on-s.patch queue-5.15/bluetooth-hci_qca-fix-the-teardown-problem-for-real.patch queue-5.15/documentation-replace-del_timer-del_timer_sync.patch queue-5.15/documentation-remove-bogus-claim-about-del_timer_sync.patch queue-5.15/timers-silently-ignore-timers-with-a-null-function.patch queue-5.15/timers-get-rid-of-del_singleshot_timer_sync.patch queue-5.15/clocksource-drivers-sp804-do-not-use-timer-namespace-for-timer_shutdown-function.patch