From 3b799254cf6f481460719023d7a18f46651e5e7f Mon Sep 17 00:00:00 2001
From: Samuel Holland <samuel@sholland.org>
Date: Sat, 1 Aug 2020 11:29:56 -0500
Subject: [PATCH] Bluetooth: hci_uart: Cancel init work before unregistering
Git-commit: 3b799254cf6f481460719023d7a18f46651e5e7f
Patch-mainline: v5.10-rc1
References: git-fixes

If hci_uart_tty_close() or hci_uart_unregister_device() is called while
hu->init_ready is scheduled, hci_register_dev() could be called after
the hci_uart is torn down. Avoid this by ensuring the work is complete
or canceled before checking the HCI_UART_REGISTERED flag.

Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers")
Signed-off-by: Samuel Holland <samuel@sholland.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
 drivers/bluetooth/hci_ldisc.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -535,6 +535,7 @@ static void hci_uart_tty_close(struct tt
 		clear_bit(HCI_UART_PROTO_READY, &hu->flags);
 		write_unlock_irqrestore(&hu->proto_lock, flags);
 
+		cancel_work_sync(&hu->init_ready);
 		cancel_work_sync(&hu->write_work);
 
 		if (hdev) {