Re: [PATCH] Bluetooth: hci_core: Fix queuing disc_work while workqueue is drained

[Jeremy Dean Clifton]

Hi Luiz,
 
Sashiko replied with two points and they are valid:
 
1. A disc_work timer armed before close sets the flag can still fire
   during drain_workqueue() and hit the same warning.

   hci_dev_close_sync(), after setting the flag and
   synchronize_rcu(), we could cancel each connection's pending delayed works
   (disc_work, idle_work, auto_accept_work, le_conn_timeout) before
   drain_workqueue(). 
 
2. Skipping disc_work can leak a connection created after
   hci_conn_hash_flush(). This one is more severe.
   Suggested fix: re-check HCI_UP after hci_dev_lock() on the connect
   path, so no connection can be created once close has cleared
   HCI_UP.

   Are these additional changes reasonable? Any feedback is welcome.


Jeremy