Merge tag 'char-misc-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here is the big set of various smaller driver subsystem updates for
  5.13-rc1.

  Major bits in here are:

   - habanalabs driver updates

   - hwtracing driver updates

   - interconnect driver updates

   - mhi driver updates

   - extcon driver updates

   - fpga driver updates

   - new binder features added

   - nvmem driver updates

   - phy driver updates

   - soundwire driver updates

   - smaller misc and char driver fixes and updates.

   - bluetooth driver bugfix that maintainer wanted to go through this
     tree.

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (330 commits)
  bluetooth: eliminate the potential race condition when removing the HCI controller
  coresight: etm-perf: Fix define build issue when built as module
  phy: Revert "phy: ti: j721e-wiz: add missing of_node_put"
  phy: ti: j721e-wiz: Add missing include linux/slab.h
  phy: phy-twl4030-usb: Fix possible use-after-free in twl4030_usb_remove()
  stm class: Use correct UUID APIs
  intel_th: pci: Add Alder Lake-M support
  intel_th: pci: Add Rocket Lake CPU support
  intel_th: Consistency and off-by-one fix
  intel_th: Constify attribute_group structs
  intel_th: Constify all drvdata references
  stm class: Remove an unused function
  habanalabs/gaudi: Fix uninitialized return code rc when read size is zero
  greybus: es2: fix kernel-doc warnings
  mei: me: add Alder Lake P device id.
  dw-xdata-pcie: Update outdated info and improve text format
  dw-xdata-pcie: Fix documentation build warns
  fbdev: zero-fill colormap in fbcmap.c
  firmware: qcom-scm: Fix QCOM_SCM configuration
  speakup: i18n: Switch to kmemdup_nul() in spk_msg_set()
  ...

1 files changed, 8 insertions, 4 deletions

diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index e55976db4403..805ce546b813 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -272,12 +272,16 @@ int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
 {
 	int ret;
 
-	if (!test_bit(HCI_UP, &hdev->flags))
-		return -ENETDOWN;
-
 	/* Serialize all requests */
 	hci_req_sync_lock(hdev);
-	ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
+	/* check the state after obtaing the lock to protect the HCI_UP
+	 * against any races from hci_dev_do_close when the controller
+	 * gets removed.
+	 */
+	if (test_bit(HCI_UP, &hdev->flags))
+		ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
+	else
+		ret = -ENETDOWN;
 	hci_req_sync_unlock(hdev);
 
 	return ret;