linux/drivers/bluetooth
Jonathan Rissanen 0ffac654e9 Bluetooth: hci_h4: Fix race during initialization
Commit 5df5dafc17 ("Bluetooth: hci_uart: Fix another race during
initialization") fixed a race for hci commands sent during initialization.
However, there is still a race that happens if an hci event from one of
these commands is received before HCI_UART_REGISTERED has been set at
the end of hci_uart_register_dev(). The event will be ignored which
causes the command to fail with a timeout in the log:

"Bluetooth: hci0: command 0x1003 tx timeout"

This is because the hci event receive path (hci_uart_tty_receive ->
h4_recv) requires HCI_UART_REGISTERED to be set in h4_recv(), while the
hci command transmit path (hci_uart_send_frame -> h4_enqueue) only
requires HCI_UART_PROTO_INIT to be set in hci_uart_send_frame().

The check for HCI_UART_REGISTERED was originally added in commit
c257820291 ("Bluetooth: Fix H4 crash from incoming UART packets")
to fix a crash caused by hu->hdev being null dereferenced. That can no
longer happen: once HCI_UART_PROTO_INIT is set in hci_uart_register_dev()
all pointers (hu, hu->priv and hu->hdev) are valid, and
hci_uart_tty_receive() already calls h4_recv() on HCI_UART_PROTO_INIT
or HCI_UART_PROTO_READY.

Remove the check for HCI_UART_REGISTERED in h4_recv() to fix the race
condition.

Fixes: 5df5dafc17 ("Bluetooth: hci_uart: Fix another race during initialization")
Signed-off-by: Jonathan Rissanen <jonathan.rissanen@axis.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2026-04-01 16:45:47 -04:00
..
Kconfig
Makefile
ath3k.c
bcm203x.c
bfusb.c
bluecard_cs.c
bpa10x.c
bt3c_cs.c
btbcm.c
btbcm.h
btintel.c
btintel.h
btintel_pcie.c
btintel_pcie.h
btmrvl_debugfs.c
btmrvl_drv.h
btmrvl_main.c
btmrvl_sdio.c
btmrvl_sdio.h
btmtk.c
btmtk.h
btmtksdio.c
btmtkuart.c
btnxpuart.c
btqca.c
btqca.h
btqcomsmd.c
btrsi.c
btrtl.c
btrtl.h
btsdio.c
btusb.c Bluetooth: btusb: clamp SCO altsetting table indices 2026-03-25 15:32:55 -04:00
dtl1_cs.c
hci_ag6xx.c
hci_aml.c
hci_ath.c
hci_bcm.c
hci_bcm4377.c
hci_bcsp.c
hci_h4.c Bluetooth: hci_h4: Fix race during initialization 2026-04-01 16:45:47 -04:00
hci_h5.c
hci_intel.c
hci_ldisc.c
hci_ll.c
hci_mrvl.c
hci_nokia.c
hci_qca.c
hci_serdev.c
hci_uart.h
hci_vhci.c
virtio_bt.c