[PATCH] Bluetooth: hci_core: Check HCI_CMD_DRAIN_WORKQUEUE in hci_cmd_timeout()

[Yang Guikun]

Bluetooth: hci_core: Check HCI_CMD_DRAIN_WORKQUEUE in hci_cmd_timeout()

hci_cmd_timeout() runs from timer softirq and queues cmd_work
unconditionally.  If the timer expires while hci_dev_close_sync() is
in drain_workqueue(), __queue_work() sees __WQ_DRAINING and warns:

  workqueue: cannot queue hci_cmd_timeout on wq hci0

cmd_timer is cancelled only after drain_workqueue(), so the window
between them is reachable when an HCI device with a command outstanding
is powered off via rfkill.

hci_cmd_work() and handle_cmd_cnt_and_timer() already skip queuing when
HCI_CMD_DRAIN_WORKQUEUE is set; hci_cmd_timeout() is the remaining
unchecked producer.

Fixes: 525daaea459f ("Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close")
Signed-off-by: Yang Guikun <yangguikun19@xxxxxx>
---
 net/bluetooth/hci_core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 209244fd9391..3333333333333 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1441,7 +1441,10 @@ static void hci_cmd_timeout(struct work_struct *work)
 		hdev->reset(hdev);
 
 	atomic_set(&hdev->cmd_cnt, 1);
-	queue_work(hdev->workqueue, &hdev->cmd_work);
+	rcu_read_lock();
+	if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
+		queue_work(hdev->workqueue, &hdev->cmd_work);
+	rcu_read_unlock();
 }
 
 /* HCI ncmd timer function */
--
2.39.5