Linux-Bluetooth Archive on
 help / color / Atom feed
From: Shuah Khan <>
Cc: Shuah Khan <>,,
Subject: [PATCH v3] bluetooth: Fix WARNING in tty_set_termios()
Date: Sun,  3 Feb 2019 09:48:25 -0700
Message-ID: <> (raw)

tty_set_termios() has the following WARN_ON which can be triggered with a
syscall to invoke TIOCSETD __NR_ioctl.

WARN_ON(tty->driver->type == TTY_DRIVER_TYPE_PTY &&
                tty->driver->subtype == PTY_TYPE_MASTER);

Johan Hovold said: "The problemm started with
commit 7721383f4199 ("Bluetooth: hci_uart: Support
operational speed during setup") which introduced a new way for how
tty_set_termios() could end up being called for a master pty."

Fix it by by preventing setting the HCI line discipline for PTYs in
hci_uart_tty_open(). Looked into keying off of tty and ldisc ops, and
couldn't find any that would be conclusive. Checking tty as such clearly
tags the reason for rejecting the request to set ldisc.

Cc: Johan Hovold <>
Cc: Marcel Holtmann <>
Cc: Al Viro <>
Signed-off-by: Shuah Khan <>
 drivers/bluetooth/hci_ldisc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index fbf7b4df23ab..a3d313fcc0f2 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -480,6 +480,11 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 	if (tty->ops->write == NULL)
 		return -EOPNOTSUPP;
+	/* don't set HCI line discipline on PTYs */
+	if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+	    tty->driver->subtype == PTY_TYPE_MASTER)
+		return -EINVAL;
 	hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL);
 	if (!hu) {
 		BT_ERR("Can't allocate control structure");

             reply index

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-03 16:48 Shuah Khan [this message]
2019-02-03 17:31 ` Marcel Holtmann
2019-02-03 19:36   ` shuah

Reply instructions:

You may reply publically to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Bluetooth Archive on

Archives are clonable:
	git clone --mirror linux-bluetooth/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-bluetooth linux-bluetooth/ \
	public-inbox-index linux-bluetooth

Newsgroup available over NNTP:

AGPL code for this site: git clone public-inbox