• Jiri Slaby's avatar
    Bluetooth: fix power_on vs close race · bf389cab
    Jiri Slaby authored
    With all the latest fixes applied, I am still able to reproduce this
    (and other) warning(s):
    WARNING: CPU: 1 PID: 19684 at ../kernel/workqueue.c:4092 destroy_workqueue+0x70a/0x770()
    ...
    Call Trace:
     [<ffffffff819fee81>] ? dump_stack+0xb3/0x112
     [<ffffffff8117377e>] ? warn_slowpath_common+0xde/0x140
     [<ffffffff811ce68a>] ? destroy_workqueue+0x70a/0x770
     [<ffffffff811739ae>] ? warn_slowpath_null+0x2e/0x40
     [<ffffffff811ce68a>] ? destroy_workqueue+0x70a/0x770
     [<ffffffffa0c944c9>] ? hci_unregister_dev+0x2a9/0x720 [bluetooth]
     [<ffffffffa0b301db>] ? vhci_release+0x7b/0xf0 [hci_vhci]
     [<ffffffffa0b30160>] ? vhci_flush+0x50/0x50 [hci_vhci]
     [<ffffffff8117cd73>] ? do_exit+0x863/0x2b90
    
    This is due to race present in the hci_unregister_dev path.
    hdev->power_on work races with hci_dev_do_close. One tries to open,
    the other tries to close, leading to warning like the above. (Another
    example is a warning in kobject_get or kobject_put depending on who
    wins the race.)
    
    Fix this by switching those two racers to ensure hdev->power_on never
    triggers while hci_dev_do_close is in progress.
    Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    bf389cab
hci_core.c 98.8 KB