1 files changed, 43 insertions, 9 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 2dda439c8cb8..ec4836f243bc 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -137,18 +137,51 @@ static void hci_conn_cleanup(struct hci_conn *conn)
         hci_conn_put(conn);
 }
 
-/* This function requires the caller holds hdev->lock */
-static void hci_connect_le_scan_remove(struct hci_conn *conn)
+static void le_scan_cleanup(struct work_struct *work)
 {
-        hci_connect_le_scan_cleanup(conn);
+        struct hci_conn *conn = container_of(work, struct hci_conn,
+                                             le_scan_cleanup);
+        struct hci_dev *hdev = conn->hdev;
+        struct hci_conn *c = NULL;
 
-        /* We can't call hci_conn_del here since that would deadlock
-         * with trying to call cancel_delayed_work_sync(&conn->disc_work).
-         * Instead, call just hci_conn_cleanup() which contains the bare
-         * minimum cleanup operations needed for a connection in this
-         * state.
+        BT_DBG("%s hcon %p", hdev->name, conn);
+
+        hci_dev_lock(hdev);
+
+        /* Check that the hci_conn is still around */
+        rcu_read_lock();
+        list_for_each_entry_rcu(c, &hdev->conn_hash.list, list) {
+                if (c == conn)
+                        break;
+        }
+        rcu_read_unlock();
+
+        if (c == conn) {
+                hci_connect_le_scan_cleanup(conn);
+                hci_conn_cleanup(conn);
+        }
+
+        hci_dev_unlock(hdev);
+        hci_dev_put(hdev);
+        hci_conn_put(conn);
+}
+
+static void hci_connect_le_scan_remove(struct hci_conn *conn)
+{
+        BT_DBG("%s hcon %p", conn->hdev->name, conn);
+
+        /* We can't call hci_conn_del/hci_conn_cleanup here since that
+         * could deadlock with another hci_conn_del() call that's holding
+         * hci_dev_lock and doing cancel_delayed_work_sync(&conn->disc_work).
+         * Instead, grab temporary extra references to the hci_dev and
+         * hci_conn and perform the necessary cleanup in a separate work
+         * callback.
          */
-        hci_conn_cleanup(conn);
+
+        hci_dev_hold(conn->hdev);
+        hci_conn_get(conn);
+
+        schedule_work(&conn->le_scan_cleanup);
 }
 
 static void hci_acl_create_connection(struct hci_conn *conn)
@@ -580,6 +613,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst,
         INIT_DELAYED_WORK(&conn->auto_accept_work, hci_conn_auto_accept);
         INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle);
         INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout);
+        INIT_WORK(&conn->le_scan_cleanup, le_scan_cleanup);
 
         atomic_set(&conn->refcnt, 0);