Linux-Bluetooth Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset()
@ 2019-01-28  6:59 Myungho Jung
  2019-01-28 12:16 ` Marcel Holtmann
  2019-01-30  9:59 ` Johan Hovold
  0 siblings, 2 replies; 4+ messages in thread
From: Myungho Jung @ 2019-01-28  6:59 UTC (permalink / raw)
  To: Marcel Holtmann, Johan Hedberg; +Cc: linux-bluetooth, linux-kernel

tiocmget() and tiocmset() operations are optional and some tty drivers
like pty miss the operations. We need NULL check before referencing
them.

Reported-by: syzbot+a950165cbb86bdd023a4@syzkaller.appspotmail.com
Signed-off-by: Myungho Jung <mhjungk@gmail.com>
---
 drivers/bluetooth/hci_ath.c   | 13 ++++++++-----
 drivers/bluetooth/hci_ldisc.c |  5 +++++
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
index d568fbd94d6c..076700a1e9a8 100644
--- a/drivers/bluetooth/hci_ath.c
+++ b/drivers/bluetooth/hci_ath.c
@@ -94,11 +94,14 @@ static void ath_hci_uart_work(struct work_struct *work)
 	hu = ath->hu;
 	tty = hu->tty;
 
-	/* verify and wake up controller */
-	if (ath->cur_sleep) {
-		status = ath_wakeup_ar3k(tty);
-		if (!(status & TIOCM_CTS))
-			return;
+	/* tiocmget() and tiocmset() operations are optional */
+	if (tty->driver->ops->tiocmget && tty->driver->ops->tiocmset) {
+		/* verify and wake up controller */
+		if (ath->cur_sleep) {
+			status = ath_wakeup_ar3k(tty);
+			if (!(status & TIOCM_CTS))
+				return;
+		}
 	}
 
 	/* Ready to send Data */
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index fbf7b4df23ab..9f88a8563cf6 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -314,6 +314,11 @@ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
 		return;
 	}
 
+	/* tiocmget() and tiocmset() operations are optional */
+	if (!tty->driver->ops->tiocmget || !tty->driver->ops->tiocmset) {
+		return;
+	}
+
 	if (enable) {
 		/* Disable hardware flow control */
 		ktermios = tty->termios;
-- 
2.17.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset()
  2019-01-28  6:59 [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset() Myungho Jung
@ 2019-01-28 12:16 ` Marcel Holtmann
  2019-01-30  9:59 ` Johan Hovold
  1 sibling, 0 replies; 4+ messages in thread
From: Marcel Holtmann @ 2019-01-28 12:16 UTC (permalink / raw)
  To: Myungho Jung; +Cc: Johan Hedberg, linux-bluetooth, linux-kernel

Hi Myungho,

> tiocmget() and tiocmset() operations are optional and some tty drivers
> like pty miss the operations. We need NULL check before referencing
> them.
> 
> Reported-by: syzbot+a950165cbb86bdd023a4@syzkaller.appspotmail.com
> Signed-off-by: Myungho Jung <mhjungk@gmail.com>
> ---
> drivers/bluetooth/hci_ath.c   | 13 ++++++++-----
> drivers/bluetooth/hci_ldisc.c |  5 +++++
> 2 files changed, 13 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
> index d568fbd94d6c..076700a1e9a8 100644
> --- a/drivers/bluetooth/hci_ath.c
> +++ b/drivers/bluetooth/hci_ath.c
> @@ -94,11 +94,14 @@ static void ath_hci_uart_work(struct work_struct *work)
> 	hu = ath->hu;
> 	tty = hu->tty;
> 
> -	/* verify and wake up controller */
> -	if (ath->cur_sleep) {
> -		status = ath_wakeup_ar3k(tty);
> -		if (!(status & TIOCM_CTS))
> -			return;
> +	/* tiocmget() and tiocmset() operations are optional */
> +	if (tty->driver->ops->tiocmget && tty->driver->ops->tiocmset) {
> +		/* verify and wake up controller */
> +		if (ath->cur_sleep) {
> +			status = ath_wakeup_ar3k(tty);
> +			if (!(status & TIOCM_CTS))
> +				return;
> +		}
> 	}

actually in case of hci_ath.c I would prefer that the setup actually fails. There is no point in continuing here. These are vendor specific hardware routines and you will not run them over TTYs that don’t support it. So instead of ignoring the operating, fail hard and cleanly during setup.

> 	/* Ready to send Data */
> diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
> index fbf7b4df23ab..9f88a8563cf6 100644
> --- a/drivers/bluetooth/hci_ldisc.c
> +++ b/drivers/bluetooth/hci_ldisc.c
> @@ -314,6 +314,11 @@ void hci_uart_set_flow_control(struct hci_uart *hu, bool enable)
> 		return;
> 	}
> 
> +	/* tiocmget() and tiocmset() operations are optional */
> +	if (!tty->driver->ops->tiocmget || !tty->driver->ops->tiocmset) {
> +		return;
> +	}
> +

No { } here please.

> 	if (enable) {
> 		/* Disable hardware flow control */
> 		ktermios = tty->termios;

Regards

Marcel


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset()
  2019-01-28  6:59 [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset() Myungho Jung
  2019-01-28 12:16 ` Marcel Holtmann
@ 2019-01-30  9:59 ` Johan Hovold
  2019-01-31  5:08   ` Myungho Jung
  1 sibling, 1 reply; 4+ messages in thread
From: Johan Hovold @ 2019-01-30  9:59 UTC (permalink / raw)
  To: Myungho Jung
  Cc: Marcel Holtmann, Johan Hedberg, linux-bluetooth, linux-kernel

On Sun, Jan 27, 2019 at 10:59:13PM -0800, Myungho Jung wrote:
> tiocmget() and tiocmset() operations are optional and some tty drivers
> like pty miss the operations. We need NULL check before referencing
> them.

Good catch. I suggest splitting these fixes in two separate patches
(after addressing Marcel's comments).

Don't forget to CC stable and add a Fixes-tag for each, as we we want to
have this backported to stable.

> Reported-by: syzbot+a950165cbb86bdd023a4@syzkaller.appspotmail.com

Actually, these two bugs were never reported by sysbot AFAIKT so no need
to give credit to anyone else here.

> Signed-off-by: Myungho Jung <mhjungk@gmail.com>
> ---
>  drivers/bluetooth/hci_ath.c   | 13 ++++++++-----
>  drivers/bluetooth/hci_ldisc.c |  5 +++++
>  2 files changed, 13 insertions(+), 5 deletions(-)

Johan

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset()
  2019-01-30  9:59 ` Johan Hovold
@ 2019-01-31  5:08   ` Myungho Jung
  0 siblings, 0 replies; 4+ messages in thread
From: Myungho Jung @ 2019-01-31  5:08 UTC (permalink / raw)
  To: Johan Hovold
  Cc: Marcel Holtmann, Johan Hedberg, linux-bluetooth, linux-kernel

On Wed, Jan 30, 2019 at 10:59:38AM +0100, Johan Hovold wrote:
> On Sun, Jan 27, 2019 at 10:59:13PM -0800, Myungho Jung wrote:
> > tiocmget() and tiocmset() operations are optional and some tty drivers
> > like pty miss the operations. We need NULL check before referencing
> > them.
> 
> Good catch. I suggest splitting these fixes in two separate patches
> (after addressing Marcel's comments).
> 
> Don't forget to CC stable and add a Fixes-tag for each, as we we want to
> have this backported to stable.
> 
> > Reported-by: syzbot+a950165cbb86bdd023a4@syzkaller.appspotmail.com
> 
> Actually, these two bugs were never reported by sysbot AFAIKT so no need
> to give credit to anyone else here.
> 
> > Signed-off-by: Myungho Jung <mhjungk@gmail.com>
> > ---
> >  drivers/bluetooth/hci_ath.c   | 13 ++++++++-----
> >  drivers/bluetooth/hci_ldisc.c |  5 +++++
> >  2 files changed, 13 insertions(+), 5 deletions(-)
> 
> Johan

Hi Johan,

Thanks for reviewing my patch. This change is not directly related to the issue
that syzbot reported but the test will keep crashing without this fix because it
will finally reach ath_hci_uart_work(). I updated and resubmitted patch.

Thanks,
Myungho

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-28  6:59 [PATCH] Bluetooth: Add NULL check for tiocmget() and tiocmset() Myungho Jung
2019-01-28 12:16 ` Marcel Holtmann
2019-01-30  9:59 ` Johan Hovold
2019-01-31  5:08   ` Myungho Jung

Linux-Bluetooth Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-bluetooth/0 linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ https://lore.kernel.org/linux-bluetooth \
		linux-bluetooth@vger.kernel.org linux-bluetooth@archiver.kernel.org
	public-inbox-index linux-bluetooth


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-bluetooth


AGPL code for this site: git clone https://public-inbox.org/ public-inbox