mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1], for rcu_sync_enter() is called without rcu_sync_init() due to hci_uart_tty_open() ignoring percpu_init_rwsem() failure. While we are at it, fix that hci_uart_register_device() ignores percpu_init_rwsem() failure and hci_uart_unregister_device() does not call percpu_free_rwsem(). Link: https://syzkaller.appspot.com/bug?extid=576dfca25381fb6fbc5f [1] Reported-by: syzbot <syzbot+576dfca25381fb6fbc5f@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes:67d2f8781b
("Bluetooth: hci_ldisc: Allow sleeping while proto locks are held.") Fixes:d73e172816
("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
parent
deee93d13d
commit
3124d320c2
|
@ -493,6 +493,11 @@ static int hci_uart_tty_open(struct tty_struct *tty)
|
|||
BT_ERR("Can't allocate control structure");
|
||||
return -ENFILE;
|
||||
}
|
||||
if (percpu_init_rwsem(&hu->proto_lock)) {
|
||||
BT_ERR("Can't allocate semaphore structure");
|
||||
kfree(hu);
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
tty->disc_data = hu;
|
||||
hu->tty = tty;
|
||||
|
@ -505,8 +510,6 @@ static int hci_uart_tty_open(struct tty_struct *tty)
|
|||
INIT_WORK(&hu->init_ready, hci_uart_init_work);
|
||||
INIT_WORK(&hu->write_work, hci_uart_write_work);
|
||||
|
||||
percpu_init_rwsem(&hu->proto_lock);
|
||||
|
||||
/* Flush any pending characters in the driver */
|
||||
tty_driver_flush_buffer(tty);
|
||||
|
||||
|
|
|
@ -310,11 +310,12 @@ int hci_uart_register_device(struct hci_uart *hu,
|
|||
|
||||
serdev_device_set_client_ops(hu->serdev, &hci_serdev_client_ops);
|
||||
|
||||
if (percpu_init_rwsem(&hu->proto_lock))
|
||||
return -ENOMEM;
|
||||
|
||||
err = serdev_device_open(hu->serdev);
|
||||
if (err)
|
||||
return err;
|
||||
|
||||
percpu_init_rwsem(&hu->proto_lock);
|
||||
goto err_rwsem;
|
||||
|
||||
err = p->open(hu);
|
||||
if (err)
|
||||
|
@ -389,6 +390,8 @@ int hci_uart_register_device(struct hci_uart *hu,
|
|||
p->close(hu);
|
||||
err_open:
|
||||
serdev_device_close(hu->serdev);
|
||||
err_rwsem:
|
||||
percpu_free_rwsem(&hu->proto_lock);
|
||||
return err;
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(hci_uart_register_device);
|
||||
|
@ -410,5 +413,6 @@ void hci_uart_unregister_device(struct hci_uart *hu)
|
|||
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
|
||||
serdev_device_close(hu->serdev);
|
||||
}
|
||||
percpu_free_rwsem(&hu->proto_lock);
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(hci_uart_unregister_device);
|
||||
|
|
Loading…
Reference in a new issue