Linux-Bluetooth Archive on lore.kernel.org
 help / color / Atom feed
From: Marcel Holtmann <marcel@holtmann.org>
To: Myungho Jung <mhjungk@gmail.com>
Cc: Johan Hedberg <johan.hedberg@gmail.com>,
	linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset()
Date: Mon, 28 Jan 2019 13:16:42 +0100
Message-ID: <0D7C928B-8E3E-4986-A6D2-AFCFF4F0E274@holtmann.org> (raw)
In-Reply-To: <20190128065910.GA14959@myunghoj-Precision-5530>

Hi Myungho,

> tiocmget() and tiocmset() operations are optional and some tty drivers
> like pty miss the operations. We need NULL check before referencing
> them.
> 
> Reported-by: syzbot+a950165cbb86bdd023a4@syzkaller.appspotmail.com
> Signed-off-by: Myungho Jung <mhjungk@gmail.com>
> ---
> drivers/bluetooth/hci_ath.c   | 13 ++++++++-----
> drivers/bluetooth/hci_ldisc.c |  5 +++++
> 2 files changed, 13 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
> index d568fbd94d6c..076700a1e9a8 100644
> --- a/drivers/bluetooth/hci_ath.c
> +++ b/drivers/bluetooth/hci_ath.c
> @@ -94,11 +94,14 @@ static void ath_hci_uart_work(struct work_struct *work)
> 	hu = ath->hu;
> 	tty = hu->tty;
> 
> -	/* verify and wake up controller */
> -	if (ath->cur_sleep) {
> -		status = ath_wakeup_ar3k(tty);
> -		if (!(status & TIOCM_CTS))
> -			return;
> +	/* tiocmget() and tiocmset() operations are optional */
> +	if (tty->driver->ops->tiocmget && tty->driver->ops->tiocmset) {
> +		/* verify and wake up controller */
> +		if (ath->cur_sleep) {
> +			status = ath_wakeup_ar3k(tty);
> +			if (!(status & TIOCM_CTS))
> +				return;
> +		}
> 	}

actually in case of hci_ath.c I would prefer that the setup actually fails. There is no point in continuing here. These are vendor specific hardware routines and you will not run them over TTYs that don’t support it. So instead of ignoring the operating, fail hard and cleanly during setup.

> 	/* Ready to send Data */
> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
> index fbf7b4df23ab..9f88a8563cf6 100644
> --- a/drivers/bluetooth/hci_ldisc.c
> +++ b/drivers/bluetooth/hci_ldisc.c
> @@ -314,6 +314,11 @@ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
> 		return;
> 	}
> 
> +	/* tiocmget() and tiocmset() operations are optional */
> +	if (!tty->driver->ops->tiocmget || !tty->driver->ops->tiocmset) {
> +		return;
> +	}
> +

No { } here please.

> 	if (enable) {
> 		/* Disable hardware flow control */
> 		ktermios = tty->termios;

Regards

Marcel


  reply index

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-28  6:59 Myungho Jung
2019-01-28 12:16 ` Marcel Holtmann [this message]
2019-01-30  9:59 ` Johan Hovold
2019-01-31  5:08   ` Myungho Jung

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=0D7C928B-8E3E-4986-A6D2-AFCFF4F0E274@holtmann.org \
    --to=marcel@holtmann.org \
    --cc=johan.hedberg@gmail.com \
    --cc=linux-bluetooth@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mhjungk@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Bluetooth Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-bluetooth/0 linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ https://lore.kernel.org/linux-bluetooth \
		linux-bluetooth@vger.kernel.org linux-bluetooth@archiver.kernel.org
	public-inbox-index linux-bluetooth


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-bluetooth


AGPL code for this site: git clone https://public-inbox.org/ public-inbox