From nobody Sun Apr 5 16:35:18 2026 Received: from mail-pl1-f175.google.com (mail-pl1-f175.google.com [209.85.214.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 41C06352C5D for ; Thu, 19 Feb 2026 17:14:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771521257; cv=none; b=ByD/EFSOZ2F/JKwJUh0+GQXAwrHQeIfsoNsJqXYVYr2SGcuVfdZW2pU0eGi3LRuY2CTA2/yfUPziTbzF8EUhjdJEb5ZlSBpxOkA+sZFGiq97vjsBn9gj+3tOOkV8dY0ALX8iQAsF5C0+vSGmWuFK55eCmZz7rYYdZprdY5o2kC4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771521257; c=relaxed/simple; bh=wtM3KGXEQuicJ8O+1w9NeLqs1Q3c/AYVobYXG6O4xkU=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=g8nQNBNN6nsAI9yPTVVQJgwUEyuo43Q3ZdprTxt5HFjFw4LWgKvIHszVoTNW6NzD1AC+xZq196HLoQMlMZyXMtj4t8mXPkbzJS5vJLS4fPeo0J9ZIJpsNeofWZFwPouQxfwY2nfAq0UzBt92LIjDuvbBgjYcSlrZIoBh0OoWw+k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZpEPYB/F; arc=none smtp.client-ip=209.85.214.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZpEPYB/F" Received: by mail-pl1-f175.google.com with SMTP id d9443c01a7336-2a79ded11a2so7731255ad.3 for ; Thu, 19 Feb 2026 09:14:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771521255; x=1772126055; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=avVd2rCSlmy3mzSueRF3eaj+JsVil8OR/Q+bsjGDE3A=; b=ZpEPYB/F3ptJD1G/dWEZjed0xgEBHRqubbvxKeqMB8yXjHJNDc70RDIDfR/SH9bqKK TLQwWeazbfydFyIHc42gKGPP16FfhJis6WFaGAQX4iylSm0fY7VZ+6QxGvVUZxoOhqVz xUXuHWB58XOEIYeD4s2v7+zKVxsJbbeOp6T74/eHqqjLfv8weOytBW14YYnLvdXjhtQz vgjqRSeF1lZY4oEtkUA2bMBxnks+AerEFEBsFHLD7OvNCJ0Ypstr2V8rngP90Y92+zIS mKeIs8zxdlzCfvl/Aihdvda6rT9cFunclEoL3BMyzbqbEJj03bA5csUCM5iOyJij5bfQ EvLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771521255; x=1772126055; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=avVd2rCSlmy3mzSueRF3eaj+JsVil8OR/Q+bsjGDE3A=; b=FjIA2fBlLFbII6y3D6qnsE9sS40bwY3aGP2+/g+x9tUcVFf4ekiZE+Q2eQJcZ30I4f A6OnXMErdekGVzeN7IbhBPodaB2Vig/GnqW0JVF/SSStPeN5Lr1o12mB//SWLHGeFzvD OvLyzjrL5nRWlkgXPCW2Y5oxucnpAkzRzCFM2H/ky5/9xaRjvVrCiuBlqap+W9vjdkLA x9u/gHumrvm7M+5hps7F/n/tPLNPm5zwPCs39Nb2TsOn6Rj0W+nBXHt9NS826zIakGix YKVh0/yhfXz5zdQ06wDXTL+aPtXRez93bkJvprPCVpG4CdZo4IKGOwUcqhw5V33Eq4+H fudQ== X-Forwarded-Encrypted: i=1; AJvYcCXiSDyk2VhMKw5OoRUF9Cj03AFBc1u6ZqoFfK/T/C40eSCQniPWeLjGk7fBE3Qy3OwsJV+ubIUb6M1G4yU=@vger.kernel.org X-Gm-Message-State: AOJu0Yyf732sUS9S8mOMeY48qJlS3zf/+SRRD2ZXZLH1IrYNeZpQYmv7 A0V39UV8ml2vztpTa3BpTRuVTEaXcsxu6hPVuYVTVc7v31hXPGSPwgsH X-Gm-Gg: AZuq6aLLQGQhM8gq6gMY7KtGfkQ1jxddvYbRMO3/KN+WHbO3hnMCnB8/vOsmBtbZNFH tuEs865QIkm4vg/7AN4VKC8jp1+4QupE6FpH48ne6BjqNM8yxCEOXPsHvTUo1lgzCHmXFQLSIkX sRXhIZAQoheDBDzV/xVq45RCfDp1+7bVe3O1jW7oi1o5q7M2H9oShnJb683+DS92urkfxJkvy/5 s1/CF/vY81hcVgd7h5qpV8MBJd5HaqHxdiQstJoXqp5nmZf0XZdGNXM1RnFjwV8EXbFy2EUlaPC 1Ckokajp113d5cAvwZDF7atl+mLMi8QyLA4J6Mj/l04UKXjEoZP/1VjXBnPETbx5mXsOxGc09yc vFlxZAmdcDagHyCc+XSsNsYmciz2jV3DuCvdMUYtPx5Hzxh6Y210xBLYilFpGLYKZUpdTOpB4Wk Ro09YrKbODQg6K3Np4Luc3B3DhPRAoXwwjLFrUWp7wODQK8lndbw== X-Received: by 2002:a17:902:f54e:b0:2aa:f798:8c7f with SMTP id d9443c01a7336-2ad50fe0da1mr59033605ad.54.1771521254568; Thu, 19 Feb 2026 09:14:14 -0800 (PST) Received: from name2965-Precision-7820-Tower.. ([121.185.236.165]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c6e532fa2e5sm15895002a12.26.2026.02.19.09.14.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Feb 2026 09:14:13 -0800 (PST) From: Jeongjun Park To: stable@vger.kernel.org Cc: gregkh@linuxfoundation.org, tglx@linutronix.de, Julia.Lawall@inria.fr, akpm@linux-foundation.org, anna-maria@linutronix.de, arnd@arndb.de, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, linux@roeck-us.net, luiz.dentz@gmail.com, marcel@holtmann.org, maz@kernel.org, peterz@infradead.org, rostedt@goodmis.org, sboyd@kernel.org, viresh.kumar@linaro.org, zouyipeng@huawei.com, aha310510@gmail.com, linux-staging@lists.linux.dev, Jacob Keller Subject: [PATCH 5.10.y 14/15] Bluetooth: hci_qca: Fix the teardown problem for real Date: Fri, 20 Feb 2026 02:13:09 +0900 Message-Id: <20260219171310.118170-15-aha310510@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260219171310.118170-1-aha310510@gmail.com> References: <20260219171310.118170-1-aha310510@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Thomas Gleixner [ Upstream commit e0d3da982c96aeddc1bbf1cf9469dbb9ebdca657 ] While discussing solutions for the teardown problem which results from circular dependencies between timers and workqueues, where timers schedule work from their timer callback and workqueues arm the timers from work items, it was discovered that the recent fix to the QCA code is incorrect. That commit fixes the obvious problem of using del_timer() instead of del_timer_sync() and reorders the teardown calls to destroy_workqueue(wq); del_timer_sync(t); This makes it less likely to explode, but it's still broken: destroy_workqueue(wq); /* After this point @wq cannot be touched anymore */ ---> timer expires queue_work(wq) <---- Results in a NULL pointer dereference deep in the work queue core code. del_timer_sync(t); Use the new timer_shutdown_sync() function to ensure that the timers are disarmed, no timer callbacks are running and the timers cannot be armed again. This restores the original teardown sequence: timer_shutdown_sync(t); destroy_workqueue(wq); which is now correct because the timer core silently ignores potential rearming attempts which can happen when destroy_workqueue() drains pending work before mopping up the workqueue. Fixes: 72ef98445aca ("Bluetooth: hci_qca: Use del_timer_sync() before freei= ng") Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Reviewed-by: Jacob Keller Reviewed-by: Anna-Maria Behnsen Acked-by: Luiz Augusto von Dentz Link: https://lore.kernel.org/all/87iljhsftt.ffs@tglx Link: https://lore.kernel.org/r/20221123201625.435907114@linutronix.de Signed-off-by: Jeongjun Park --- drivers/bluetooth/hci_qca.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c index 66f416f59a8d..204ba1de624d 100644 --- a/drivers/bluetooth/hci_qca.c +++ b/drivers/bluetooth/hci_qca.c @@ -710,9 +710,15 @@ static int qca_close(struct hci_uart *hu) skb_queue_purge(&qca->tx_wait_q); skb_queue_purge(&qca->txq); skb_queue_purge(&qca->rx_memdump_q); + /* + * Shut the timers down so they can't be rearmed when + * destroy_workqueue() drains pending work which in turn might try + * to arm a timer. After shutdown rearm attempts are silently + * ignored by the timer core code. + */ + timer_shutdown_sync(&qca->tx_idle_timer); + timer_shutdown_sync(&qca->wake_retrans_timer); destroy_workqueue(qca->workqueue); - del_timer_sync(&qca->tx_idle_timer); - del_timer_sync(&qca->wake_retrans_timer); qca->hu =3D NULL; =20 kfree_skb(qca->rx_skb); --