From nobody Thu Apr 2 22:28:55 2026 Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11011043.outbound.protection.outlook.com [40.107.130.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D881C392836; Thu, 26 Mar 2026 09:59:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.130.43 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774519169; cv=fail; b=aYGM36NqzUdQdtbBg5mVRLKP15IVZmQxLkkxZQfdBEAypBCY6wzYk4qRhupnQzak5VpfASveRM7uoQSUAa6RM2aAR1KHkTWwZ1N1KzIIxhYtjDHB4vJpDpWTV15QCgaLTcSWWQ67+qJBw5ZumipQaiIpz0HVE0GzuOQwUrlGdfM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774519169; c=relaxed/simple; bh=8udnt9i+2PL8Qi6oNZ2Ly2mPJn063BgF9y3YW4pNKTs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=hcH+Ud+L0hqFeSDsZBVerlhLewbmFo8YamwB0aHPZjLoo+AAbxgcjYWj2mpponWztEJ0cl/mpKrua9dB08fLzeIcoKTf+lhPt71Rc0xJM3jysvkbiNAsSiDHtjs6eKPIC/J6YZ3903LLfgkFgI2XKnDUetVA3e84PgG8gQ9RNqw= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=axis.com; spf=pass smtp.mailfrom=axis.com; dkim=pass (1024-bit key) header.d=axis.com header.i=@axis.com header.b=HkCIG7cf; arc=fail smtp.client-ip=40.107.130.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=axis.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=axis.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=axis.com header.i=@axis.com header.b="HkCIG7cf" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=h6cpPLbGL2VdWaWXJaBbNu+VbtBO3wc34vPJy2EGTrqd9QTN7Jllz57SgcbpjTHJRXo7S2maTmDyQD4jpFF7DWnIgRSpsTK9+6w6i3JHm1GRhd7DFkQjZa3EciVXbqgkbgrQm5Fh8qW1hhhGVu5DnH1G/XGwKlP9b3kAEWo1WNOA9VcnqMNjq2JqKIIB5ZP8P/6AeKYROmdo8Ii8VXMm97Zyy428CCWyhWNlIxx+IAhL9MceNb1YWUkIrIs2KJf+ylu5f8BM32drWTnhdqOKvYOZe913MfGpRm98rl/0vTxeOGYHgrYIbzrmEZoo2JQrIHHU+mYSPtoyg6OV42qOPg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ZdLMNF3FE+CrexfOlE0XwAXSCiBVIdR+l3Nlx3kWgDo=; b=uyVKSFLOVcKSoMKH1E3rQClf4ngax4FewGZ32DrU9eYbAhKuME0a2p/xcou6IRSlnezFGcqkbyb4yAK/MXV2+wC3migsScmNXwn/MmdbHHHb7ry65SQwTleu8b3AkbO+U3LlQYTISaRnOYBUWa7lGH8qLeIeLVtm3g3T9r6qfigsqdqF3Cb12II6AC+5SI1kYtkj22CmZw/gfMOJGjz/3Sc8zkZ04SmMQLpDdTLFPv9fvCciyv65//rFznZNYqwL+EGdtCNhlnix28X9Aeu0SuEp6qUFk13SN5PsuYri2ompfuoApCadSrX9UNTWBAPwrVWRexF6UgjLrBuRC1sjIw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 195.60.68.100) smtp.rcpttodomain=gmail.com smtp.mailfrom=axis.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=axis.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axis.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ZdLMNF3FE+CrexfOlE0XwAXSCiBVIdR+l3Nlx3kWgDo=; b=HkCIG7cfTIlalFLki1d8/90mhkGY3bSZqoVST2yYJkcwsgc8wMD6FIZseSKzzwEKZrcu92qUydIlcqzPjq8dlsW0nrNqzrKdwts5KvT0eSqppQ7jIfPyymJAqgm7sjm4KGfqb9pw2yO4UBIIEAhn/wzjUKlENPne+FEpqQ1R9HE= Received: from DU7PR01CA0031.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::10) by AM9PR02MB7092.eurprd02.prod.outlook.com (2603:10a6:20b:26e::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.20; Thu, 26 Mar 2026 09:59:24 +0000 Received: from DU6PEPF0000952A.eurprd02.prod.outlook.com (2603:10a6:10:50e:cafe::1b) by DU7PR01CA0031.outlook.office365.com (2603:10a6:10:50e::10) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Thu, 26 Mar 2026 09:59:17 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 195.60.68.100) smtp.mailfrom=axis.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=axis.com; Received-SPF: Pass (protection.outlook.com: domain of axis.com designates 195.60.68.100 as permitted sender) receiver=protection.outlook.com; client-ip=195.60.68.100; helo=mail.axis.com; pr=C Received: from mail.axis.com (195.60.68.100) by DU6PEPF0000952A.mail.protection.outlook.com (10.167.8.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Thu, 26 Mar 2026 09:59:24 +0000 Received: from SE-MAILARCH01W.axis.com (10.20.40.15) by se-mail11w.axis.com (10.20.40.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.2.1748.39; Thu, 26 Mar 2026 10:59:21 +0100 Received: from se-mail11w.axis.com (10.20.40.11) by SE-MAILARCH01W.axis.com (10.20.40.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.61; Thu, 26 Mar 2026 10:59:21 +0100 Received: from se-intmail01x.se.axis.com (10.4.0.28) by se-mail11w.axis.com (10.20.40.11) with Microsoft SMTP Server id 15.2.1748.39 via Frontend Transport; Thu, 26 Mar 2026 10:59:21 +0100 Received: from pc56869-2347.se.axis.com (pc56869-2347.se.axis.com [10.94.2.37]) by se-intmail01x.se.axis.com (Postfix) with ESMTP id 8184347FA; Thu, 26 Mar 2026 10:59:21 +0100 (CET) Received: by pc56869-2347.se.axis.com (Postfix, from userid 18630) id 8BB0A602E188; Thu, 26 Mar 2026 10:59:21 +0100 (CET) From: Jonathan Rissanen Date: Thu, 26 Mar 2026 10:59:08 +0100 Subject: [PATCH v2 1/2] Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260326-hci-init-fix-v2-1-a974211d0224@axis.com> References: <20260326-hci-init-fix-v2-0-a974211d0224@axis.com> In-Reply-To: <20260326-hci-init-fix-v2-0-a974211d0224@axis.com> To: Marcel Holtmann , Luiz Augusto von Dentz CC: , , Jonathan Rissanen , X-Mailer: b4 0.14.3 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000952A:EE_|AM9PR02MB7092:EE_ X-MS-Office365-Filtering-Correlation-Id: 68d2d05e-db28-40d3-472f-08de8b1e5c09 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|1800799024|376014|36860700016|18002099003|56012099003|22082099003; X-Microsoft-Antispam-Message-Info: l3cE8tdV25hpA68V04XpGYzV3R3HeDCKdFdfU0iKbTjuEDjXSDjTJ2bNhMWFoTnAKkq9NztGD2HbqqPMEY+241B8pXOO4QwFjs2yUwHEp9pfeX4+aTqFj9mTkjtw9f/LiPPV5IL5OtYBaIg+nYpzo816DNLzAka3GfMCrt1BaAmnQyxjGGV06Wo408MDqxSpFHt4X80vl68ePTr9NRqcmm7ZxhafuzLtBO93cJ8f4rkwW6xiPkGfsGJHlngu5XZPXiMvwZCG/GtPkLROg8lARw2cKvfX8/CMcnS81MyP1UkOHM62i0tdq2nmN34Z1EIYn7o7btFMa59/bjon/JIpPCEtKvYFU3zvQoS+0Jbo4bvQHSh2B3QW9QH0vIfDcE2qmg6Smv6H8sn5fvTKZJm39ZsCAcmAAutxtR/BFk4vOlZ/lNunGBtto8Vvudfwf+vge27hxdbNW+j0R7Ad0+hlRk3XhFQB5jn/CmgjtbGrNiOwmHP6sBWQ0Uya4dDM/+ORmLMygiBFjzT65bO1G5GciUyuL6m9gZEK1PZ9z1FoltVgXKXT9M90XSbehY4WoNmEb4XwOEprknvJyqieNNZyFhw2fI/oac7TTmfRNWvxx9CJ/VkJCd+CvVfcSbzq9eH1EVNERvQOSTZqxAWHOCcc2m2llxLuce2b+NeNOHo/WIvOT0keazEub/G1kOCcHEreoFJY4Hfl3hhPAKl07q7DdtD5rg58tDEo1Grimz0yETz49Hgi0pbP0/PjBCtSeCcqjkiSwSVBpcbgQiZABLMw6g== X-Forefront-Antispam-Report: CIP:195.60.68.100;CTRY:SE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.axis.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(82310400026)(1800799024)(376014)(36860700016)(18002099003)(56012099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: nZ+yGcdEMqhEM1TpK0sM+xBtKnhOOJ0IGJaJ6Xp6IMh6HyXxsYm8/0Wvqp3hWeMFat/V8dcfGyJa4UvDE37Ukgc79hBBp7EHbRxUWdEIwUM08HzLHjvB22xD7ny5Cd9tQYC8F3NsHE3t2F/btAPvIclHL0fbfpGlOqlTAptkFYWrHJu6MS3mH/D5uwRrbBVpdeneDdVe/OU1VEhwra/wLtV5XhsIBo6bEpWv59TmqvUktWE7wlZ/yQLlicF53dQRST9rgNQOTzbArJU/u/df0IwYT61cBayKaVJ7qJijoNHe7SiHUaagfNgOYobzeuPxSQH24xgLPIzC8gPqm196LwbyD68sk3IF2N9KKxrAyPaz5ls19cOuoZFxAPyoI/JbCoSJb9UQcpvKRqTjPcbF2q3dYoKSvrizFGOBeoJxSop7dht4OjtHJ23JLH1ZaaRP X-OriginatorOrg: axis.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2026 09:59:24.2082 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 68d2d05e-db28-40d3-472f-08de8b1e5c09 X-MS-Exchange-CrossTenant-Id: 78703d3c-b907-432f-b066-88f7af9ca3af X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=78703d3c-b907-432f-b066-88f7af9ca3af;Ip=[195.60.68.100];Helo=[mail.axis.com] X-MS-Exchange-CrossTenant-AuthSource: DU6PEPF0000952A.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9PR02MB7092 When hci_register_dev() fails in hci_uart_register_dev() HCI_UART_PROTO_INIT is not cleared before calling hu->proto->close(hu) and setting hu->hdev to NULL. This means incoming UART data will reach the protocol-specific recv handler in hci_uart_tty_receive() after resources are freed. Clear HCI_UART_PROTO_INIT with a write lock before calling hu->proto->close() and setting hu->hdev to NULL. The write lock ensures all active readers have completed and no new reader can enter the protocol recv path before resources are freed. This allows the protocol-specific recv functions to remove the "HCI_UART_REGISTERED" guard without risking a null pointer dereference if hci_register_dev() fails. Signed-off-by: Jonathan Rissanen --- drivers/bluetooth/hci_ldisc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 2b28515de92c..5455990ab211 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -692,6 +692,9 @@ static int hci_uart_register_dev(struct hci_uart *hu) =20 if (hci_register_dev(hdev) < 0) { BT_ERR("Can't register HCI device"); + percpu_down_write(&hu->proto_lock); + clear_bit(HCI_UART_PROTO_INIT, &hu->flags); + percpu_up_write(&hu->proto_lock); hu->proto->close(hu); hu->hdev =3D NULL; hci_free_dev(hdev); --=20 2.39.5 From nobody Thu Apr 2 22:28:55 2026 Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11010053.outbound.protection.outlook.com [52.101.69.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2628387357; Thu, 26 Mar 2026 09:59:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.69.53 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774519170; cv=fail; b=bIbwybAx1VVJQipgdq+uZ2ctGy14XIPVnLVPCeRo3IbpA60Pfh+KuJ07rn+X4ZKksa+Wrw4irzbdfYCirtEOZfzrfeNvoP3lF8DwQIjl7XUsHM0bwaKk3lHBgFpZA682rM7L6P5we86dij3QX6xxwlz5FcbqdRa6PekZwfefBD4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774519170; c=relaxed/simple; bh=aOjShqR+dhTKowbBEQCni7qrAypUUHojiYO97zPuAK4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-ID:References: In-Reply-To:To:CC; b=m0PAgXSNQhGc8dUe7cFzSk1WqBvHseT4LnElq/zTcNEyctOV3iFANY7VyCLtQ97YtF2VVezotEzeBqiGLQD1B3VV4Un/HSngro/0/TUhBnjpUmkx9y/5PS5JDyzo+CIqk1QSAqLIn96UT5+KnMFz+Azu5DNR8WVvTMM+zHHY5Oc= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=axis.com; spf=pass smtp.mailfrom=axis.com; dkim=pass (1024-bit key) header.d=axis.com header.i=@axis.com header.b=CNXUsdx4; arc=fail smtp.client-ip=52.101.69.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=axis.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=axis.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=axis.com header.i=@axis.com header.b="CNXUsdx4" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=L2hW88hTDuG3JOA7dSEZFd4QEOkiNMFz1ZOj8Bqn1swp9FjYgvaey70QyFMdhnotEV6DaVIkmrTLSH9+ErYm/sdNFwJWpW8Xn88hXLSV+Nih/ZJ5/E21wUkAE2cY4efxNzjTg4THOeU3Vd4YS1g8Uw4wIEtqBT5hS6GTzWqXcbXgoyBIxWMkS57gNvwLhGH9K9/ORbJu+cAfO8ZOWi7LEVdGyDjsHlh3JQWcSg9HBtGSIC5/hcM6CSatEE2+mR25beeqs/NN6JGxJ0bTMN1B+FPio9fBUbnZMMfGB4u9okoDq3/+lMs0OgZziACpVfAbhfUv/WMZ27FrfpQOqtmOng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=HV33FTFSDx2C2jfk3VfjB2dSC0HMWNouUAjuRNgTK/A=; b=qZKAttHSuVCtVkUHerGDCAcDN+kQg1NNWs4bZJ8h4BgM9zbGjd4iXx4por4STYJaG7IrgVPdumUo6CQJjkcgcrRbnTWKZ1HSrxK+OHobz4WUYbdMi+ymcgmoOMreCUjDWMxUE50nG0dmSNdGc8dbpUtQK55AiXuHh7u/ykYjskUEtmVPzjuyfpwY1k+BcuPC6Rv/HtZrsh7k+/o7phXmVmlgK6VyMt9USTkRbYu1wWijQQpj/5jyQTttVoA24N+uameKYYswtAKv3ITGixjNSpMDYfhar2bWBLO7Rpg4x5M8Bic6BB9B/7m3JgHVr/SZF/VZZcMz3loaJjU2Ba2jPQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 195.60.68.100) smtp.rcpttodomain=gmail.com smtp.mailfrom=axis.com; dmarc=pass (p=none sp=none pct=100) action=none header.from=axis.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axis.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HV33FTFSDx2C2jfk3VfjB2dSC0HMWNouUAjuRNgTK/A=; b=CNXUsdx4AvPK9Iq2NMhuLC9/4vIt2okaJPk2rIpdyhy+9QVEvA2HNRh1iNGLSLpWXuchoD2LgM9Kkkg6cqnKQGEz6BSHUljIiG6RbUzUG5XY7uLWqTxYJW8WScauBq5mm266RyRvGLysO/YunsndPxM+ExZzfnGhsuPb0UpQz6M= Received: from DU7PR01CA0035.eurprd01.prod.exchangelabs.com (2603:10a6:10:50e::16) by GVXPR02MB11602.eurprd02.prod.outlook.com (2603:10a6:150:326::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9723.31; Thu, 26 Mar 2026 09:59:22 +0000 Received: from DU6PEPF0000952A.eurprd02.prod.outlook.com (2603:10a6:10:50e:cafe::bc) by DU7PR01CA0035.outlook.office365.com (2603:10a6:10:50e::16) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.9723.32 via Frontend Transport; Thu, 26 Mar 2026 09:59:23 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 195.60.68.100) smtp.mailfrom=axis.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=axis.com; Received-SPF: Pass (protection.outlook.com: domain of axis.com designates 195.60.68.100 as permitted sender) receiver=protection.outlook.com; client-ip=195.60.68.100; helo=mail.axis.com; pr=C Received: from mail.axis.com (195.60.68.100) by DU6PEPF0000952A.mail.protection.outlook.com (10.167.8.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9745.21 via Frontend Transport; Thu, 26 Mar 2026 09:59:22 +0000 Received: from se-mail11w.axis.com (10.20.40.11) by se-mail11w.axis.com (10.20.40.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1748.39; Thu, 26 Mar 2026 10:59:21 +0100 Received: from se-intmail01x.se.axis.com (10.4.0.28) by se-mail11w.axis.com (10.20.40.11) with Microsoft SMTP Server id 15.2.1748.39 via Frontend Transport; Thu, 26 Mar 2026 10:59:21 +0100 Received: from pc56869-2347.se.axis.com (pc56869-2347.se.axis.com [10.94.2.37]) by se-intmail01x.se.axis.com (Postfix) with ESMTP id 8236D480E; Thu, 26 Mar 2026 10:59:21 +0100 (CET) Received: by pc56869-2347.se.axis.com (Postfix, from userid 18630) id 8CF7D602BC93; Thu, 26 Mar 2026 10:59:21 +0100 (CET) From: Jonathan Rissanen Date: Thu, 26 Mar 2026 10:59:09 +0100 Subject: [PATCH v2 2/2] Bluetooth: hci_h4: Fix race during initialization Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID: <20260326-hci-init-fix-v2-2-a974211d0224@axis.com> References: <20260326-hci-init-fix-v2-0-a974211d0224@axis.com> In-Reply-To: <20260326-hci-init-fix-v2-0-a974211d0224@axis.com> To: Marcel Holtmann , Luiz Augusto von Dentz CC: , , Jonathan Rissanen , X-Mailer: b4 0.14.3 X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU6PEPF0000952A:EE_|GVXPR02MB11602:EE_ X-MS-Office365-Filtering-Correlation-Id: 06ade78f-6efe-48ab-3ab2-08de8b1e5ae1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|82310400026|376014|36860700016|56012099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: aZffABHRAqtJAbV/y6IZ6/VGAYOgt+YwTR919uuNXyztsWQJ+ttoJHA4sUEbpGdX4feb6srADGIxWmbbNS0nn42hv83WaKVz529LlMLzr35Bp3KWKgWxxAePs/STCt1UnZDNrkSp+i4glCW6XiJFe5OwWS5+1Ep6M5LcVx+gLPcR/pTmClY4xkSudEmGxi7SkXRJh+hmfbNnUfTFnNlKFt6n4LuaRUnHBHO6mTZEiyQ74GqEruqiSr60BrTQ5Fzi59YNgHHdlcnaAs2Rqg7yJyCUmBVJskvmGYrCKC2IA+2W9ayAuww+3E/utDYzd3nFJg5F4HYRc+kHuBNUinhrxpxZ7/eWYy3IA8PxPlJ4iAByCbcAQDLG6Ysn0Y2iJvn6c7t2XKEOg0t/tQVb8R0F58CAZ5nbtvUfAmEVn8xkPVG66Ca9CrH03kySB4ImkGjubOyLCd7YwbU1gmkC3gNJwN/KjCoVckbPsHwQY7QLF4nQ+hGakdrwmKdePRawG4boakgVNZjQLiITDJtebA7Ccw/A/BftOBGNODyuY51ThCt2bHGFxhZJR0oRufqCNMmWasuc6biJsdNPEgNt0GrlDAeCB+Jzyb9UWWW/GuNWTz35nJvmYUxHPAxHdYZ4mXsORkXFYDnJVlDuvW/WtErIuFpz+ioeWL95/Iho6BQmCR3rqY78SnermML4FY6fq3bGfABk5svNpUV2VieQHrgnRPoRK9t4hmnEpoONOCjx53O1n2z0HtTcf+WneAvYAATTm11T0nlqEacnTEOvrC6S1w== X-Forefront-Antispam-Report: CIP:195.60.68.100;CTRY:SE;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.axis.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230040)(1800799024)(82310400026)(376014)(36860700016)(56012099003)(22082099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Rt3rT9+Hb8xZT0g20TEvemHm140yGJZ/OFY1raZhj1PUJuETZOTwrUtD3Lj0fAFS75KptkCebHjynBVLjidFgnFe9W8B3s4eUH5Re5qu2xPi/6BhGcAlO9lqcGWAJTciuMzYA/0raEvVLy1VJFu6ELxRTidAAQPvR1Yg3SdavLMzR5wCjKEYSeTd/yus2Fuo3gOs54PzekQpjFHG8pELWoxbVX26LpUuXk044P8Mj9Ou1ftztCEANnFl48efNB50h616Hq9wnjLp4uCcc4f3mNHYLgdXW2XFewnqLeNiu9Ju8+2k/btDmpyg0G3wnBcymw5UBagfxJYYkBTlWVbS3TkLJglWTB3xM5CRuzlAqji0uBszGAAbt8B66qV/A2VwyvNjkAPlFxXqlnMf+iYDmxcMo/wWKn5y0fPZR6yVMV7YWsyBtRI1jED3j26ubMlV X-OriginatorOrg: axis.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2026 09:59:22.2679 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 06ade78f-6efe-48ab-3ab2-08de8b1e5ae1 X-MS-Exchange-CrossTenant-Id: 78703d3c-b907-432f-b066-88f7af9ca3af X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=78703d3c-b907-432f-b066-88f7af9ca3af;Ip=[195.60.68.100];Helo=[mail.axis.com] X-MS-Exchange-CrossTenant-AuthSource: DU6PEPF0000952A.eurprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: GVXPR02MB11602 Commit 5df5dafc171b ("Bluetooth: hci_uart: Fix another race during initialization") fixed a race for hci commands sent during initialization. However, there is still a race that happens if an hci event from one of these commands is received before HCI_UART_REGISTERED has been set at the end of hci_uart_register_dev(). The event will be ignored which causes the command to fail with a timeout in the log: "Bluetooth: hci0: command 0x1003 tx timeout" This is because the hci event receive path (hci_uart_tty_receive -> h4_recv) requires HCI_UART_REGISTERED to be set in h4_recv(), while the hci command transmit path (hci_uart_send_frame -> h4_enqueue) only requires HCI_UART_PROTO_INIT to be set in hci_uart_send_frame(). The check for HCI_UART_REGISTERED was originally added in commit c2578202919a ("Bluetooth: Fix H4 crash from incoming UART packets") to fix a crash caused by hu->hdev being null dereferenced. That can no longer happen: once HCI_UART_PROTO_INIT is set in hci_uart_register_dev() all pointers (hu, hu->priv and hu->hdev) are valid, and hci_uart_tty_receive() already calls h4_recv() on HCI_UART_PROTO_INIT or HCI_UART_PROTO_READY. Remove the check for HCI_UART_REGISTERED in h4_recv() to fix the race condition. Signed-off-by: Jonathan Rissanen --- drivers/bluetooth/hci_h4.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c index ec017df8572c..1e9e2cad9ddf 100644 --- a/drivers/bluetooth/hci_h4.c +++ b/drivers/bluetooth/hci_h4.c @@ -109,9 +109,6 @@ static int h4_recv(struct hci_uart *hu, const void *dat= a, int count) { struct h4_struct *h4 =3D hu->priv; =20 - if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) - return -EUNATCH; - h4->rx_skb =3D h4_recv_buf(hu, h4->rx_skb, data, count, h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts)); if (IS_ERR(h4->rx_skb)) { --=20 2.39.5