Commit 3124d320 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure 

syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1],
for rcu_sync_enter() is called without rcu_sync_init() due to
hci_uart_tty_open() ignoring percpu_init_rwsem() failure.

While we are at it, fix that hci_uart_register_device() ignores
percpu_init_rwsem() failure and hci_uart_unregister_device() does not
call percpu_free_rwsem().

Link: https://syzkaller.appspot.com/bug?extid=576dfca25381fb6fbc5f

 [1]
Reported-by: default avatarsyzbot <syzbot+576dfca25381fb6fbc5f@syzkaller.appspotmail.com>
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Fixes: 67d2f878 ("Bluetooth: hci_ldisc: Allow sleeping while proto locks are held.")
Fixes: d73e1728 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops")
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent deee93d1

drivers/bluetooth/hci_ldisc.c

+5 −2
Original line number Diff line number Diff line
@@ -493,6 +493,11 @@ static int hci_uart_tty_open(struct tty_struct *tty) 
		BT_ERR("Can't allocate control structure");

		return -ENFILE;

	}

	if (percpu_init_rwsem(&hu->proto_lock)) {

		BT_ERR("Can't allocate semaphore structure");

		kfree(hu);

		return -ENOMEM;

	}



	tty->disc_data = hu;

	hu->tty = tty;
@@ -505,8 +510,6 @@ static int hci_uart_tty_open(struct tty_struct *tty) 
	INIT_WORK(&hu->init_ready, hci_uart_init_work);

	INIT_WORK(&hu->write_work, hci_uart_write_work);



	percpu_init_rwsem(&hu->proto_lock);



	/* Flush any pending characters in the driver */

	tty_driver_flush_buffer(tty);

drivers/bluetooth/hci_serdev.c

+7 −3
Original line number Diff line number Diff line
@@ -310,11 +310,12 @@ int hci_uart_register_device(struct hci_uart *hu, 


	serdev_device_set_client_ops(hu->serdev, &hci_serdev_client_ops);



	if (percpu_init_rwsem(&hu->proto_lock))

		return -ENOMEM;



	err = serdev_device_open(hu->serdev);

	if (err)

		return err;



	percpu_init_rwsem(&hu->proto_lock);

		goto err_rwsem;



	err = p->open(hu);

	if (err)
@@ -389,6 +390,8 @@ int hci_uart_register_device(struct hci_uart *hu, 
	p->close(hu);

err_open:

	serdev_device_close(hu->serdev);

err_rwsem:

	percpu_free_rwsem(&hu->proto_lock);

	return err;

}

EXPORT_SYMBOL_GPL(hci_uart_register_device);
@@ -410,5 +413,6 @@ void hci_uart_unregister_device(struct hci_uart *hu) 
		clear_bit(HCI_UART_PROTO_READY, &hu->flags);

		serdev_device_close(hu->serdev);

	}

	percpu_free_rwsem(&hu->proto_lock);

}

EXPORT_SYMBOL_GPL(hci_uart_unregister_device);