Bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close
[linux-flexiantxendom0.git] / drivers / bluetooth / hci_ldisc.c
index 573ff6c..8f3d6db 100644 (file)
  *
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
 
 #include "hci_uart.h"
 
-#ifndef CONFIG_BT_HCIUART_DEBUG
-#undef  BT_DBG
-#define BT_DBG( A... )
-#endif
-
 #define VERSION "2.2"
 
 static int reset = 0;
@@ -108,7 +101,7 @@ static inline void hci_uart_tx_complete(struct hci_uart *hu, int pkt_type)
                break;
 
        case HCI_SCODATA_PKT:
-               hdev->stat.cmd_tx++;
+               hdev->stat.sco_tx++;
                break;
        }
 }
@@ -145,7 +138,7 @@ restart:
                int len;
 
                set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-               len = tty->driver->write(tty, skb->data, skb->len);
+               len = tty->ops->write(tty, skb->data, skb->len);
                hdev->stat.byte_tx += len;
 
                skb_pull(skb, len);
@@ -192,8 +185,7 @@ static int hci_uart_flush(struct hci_dev *hdev)
 
        /* Flush any pending characters in the driver and discipline. */
        tty_ldisc_flush(tty);
-       if (tty->driver->flush_buffer)
-               tty->driver->flush_buffer(tty);
+       tty_driver_flush_buffer(tty);
 
        if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
                hu->proto->flush(hu);
@@ -210,6 +202,7 @@ static int hci_uart_close(struct hci_dev *hdev)
                return 0;
 
        hci_uart_flush(hdev);
+       hdev->flush = NULL;
        return 0;
 }
 
@@ -217,11 +210,10 @@ static int hci_uart_close(struct hci_dev *hdev)
 static int hci_uart_send_frame(struct sk_buff *skb)
 {
        struct hci_dev* hdev = (struct hci_dev *) skb->dev;
-       struct tty_struct *tty;
        struct hci_uart *hu;
 
        if (!hdev) {
-               BT_ERR("Frame for uknown device (hdev=NULL)");
+               BT_ERR("Frame for unknown device (hdev=NULL)");
                return -ENODEV;
        }
 
@@ -229,7 +221,6 @@ static int hci_uart_send_frame(struct sk_buff *skb)
                return -EBUSY;
 
        hu = (struct hci_uart *) hdev->driver_data;
-       tty = hu->tty;
 
        BT_DBG("%s: type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
@@ -242,15 +233,10 @@ static int hci_uart_send_frame(struct sk_buff *skb)
 
 static void hci_uart_destruct(struct hci_dev *hdev)
 {
-       struct hci_uart *hu;
-
        if (!hdev)
                return;
 
        BT_DBG("%s", hdev->name);
-
-       hu = (struct hci_uart *) hdev->driver_data;
-       kfree(hu);
 }
 
 /* ------ LDISC part ------ */
@@ -269,16 +255,24 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
        BT_DBG("tty %p", tty);
 
+       /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
+          the pointer */
        if (hu)
                return -EEXIST;
 
+       /* Error if the tty has no write op instead of leaving an exploitable
+          hole */
+       if (tty->ops->write == NULL)
+               return -EOPNOTSUPP;
+
        if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
-               BT_ERR("Can't allocate controll structure");
+               BT_ERR("Can't allocate control structure");
                return -ENFILE;
        }
 
        tty->disc_data = hu;
        hu->tty = tty;
+       tty->receive_room = 65536;
 
        spin_lock_init(&hu->rx_lock);
 
@@ -287,11 +281,9 @@ static int hci_uart_tty_open(struct tty_struct *tty)
        /* FIXME: why is this needed. Note don't use ldisc_ref here as the
           open path is before the ldisc is referencable */
 
-       if (tty->ldisc.flush_buffer)
-               tty->ldisc.flush_buffer(tty);
-
-       if (tty->driver->flush_buffer)
-               tty->driver->flush_buffer(tty);
+       if (tty->ldisc->ops->flush_buffer)
+               tty->ldisc->ops->flush_buffer(tty);
+       tty_driver_flush_buffer(tty);
 
        return 0;
 }
@@ -312,13 +304,18 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 
        if (hu) {
                struct hci_dev *hdev = hu->hdev;
-               hci_uart_close(hdev);
+
+               if (hdev)
+                       hci_uart_close(hdev);
 
                if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
+                       if (hdev) {
+                               hci_unregister_dev(hdev);
+                               hci_free_dev(hdev);
+                       }
                        hu->proto->close(hu);
-                       hci_unregister_dev(hdev);
-                       hci_free_dev(hdev);
                }
+               kfree(hu);
        }
 }
 
@@ -348,20 +345,6 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty)
                hci_uart_tx_wakeup(hu);
 }
 
-/* hci_uart_tty_room()
- * 
- *    Callback function from tty driver. Return the amount of 
- *    space left in the receiver's buffer to decide if remote
- *    transmitter is to be throttled.
- *
- * Arguments:        tty    pointer to associated tty instance data
- * Return Value:    number of bytes left in receive buffer
- */
-static int hci_uart_tty_room (struct tty_struct *tty)
-{
-       return 65536;
-}
-
 /* hci_uart_tty_receive()
  * 
  *     Called by tty low level driver when receive data is
@@ -374,7 +357,7 @@ static int hci_uart_tty_room (struct tty_struct *tty)
  *     
  * Return Value:    None
  */
-static void hci_uart_tty_receive(struct tty_struct *tty, const __u8 *data, char *flags, int count)
+static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, char *flags, int count)
 {
        struct hci_uart *hu = (void *)tty->disc_data;
 
@@ -389,8 +372,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const __u8 *data, char
        hu->hdev->stat.byte_rx += count;
        spin_unlock(&hu->rx_lock);
 
-       if (test_and_clear_bit(TTY_THROTTLED,&tty->flags) && tty->driver->unthrottle)
-               tty->driver->unthrottle(tty);
+       tty_unthrottle(tty);
 }
 
 static int hci_uart_register_dev(struct hci_uart *hu)
@@ -408,7 +390,7 @@ static int hci_uart_register_dev(struct hci_uart *hu)
 
        hu->hdev = hdev;
 
-       hdev->type = HCI_UART;
+       hdev->bus = HCI_UART;
        hdev->driver_data = hu;
 
        hdev->open  = hci_uart_open;
@@ -416,11 +398,15 @@ static int hci_uart_register_dev(struct hci_uart *hu)
        hdev->flush = hci_uart_flush;
        hdev->send  = hci_uart_send_frame;
        hdev->destruct = hci_uart_destruct;
+       hdev->parent = hu->tty->dev;
 
        hdev->owner = THIS_MODULE;
 
-       if (reset)
-               set_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks);
+       if (!reset)
+               set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+
+       if (test_bit(HCI_UART_RAW_DEVICE, &hu->hdev_flags))
+               set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 
        if (hci_register_dev(hdev) < 0) {
                BT_ERR("Can't register HCI device");
@@ -488,17 +474,31 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file * file,
                                clear_bit(HCI_UART_PROTO_SET, &hu->flags);
                                return err;
                        }
-                       tty->low_latency = 1;
                } else
                        return -EBUSY;
+               break;
 
        case HCIUARTGETPROTO:
                if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
                        return hu->proto->id;
                return -EUNATCH;
 
+       case HCIUARTGETDEVICE:
+               if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+                       return hu->hdev->id;
+               return -EUNATCH;
+
+       case HCIUARTSETFLAGS:
+               if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+                       return -EBUSY;
+               hu->hdev_flags = arg;
+               break;
+
+       case HCIUARTGETFLAGS:
+               return hu->hdev_flags;
+
        default:
-               err = n_tty_ioctl(tty, file, cmd, arg);
+               err = n_tty_ioctl_helper(tty, file, cmd, arg);
                break;
        };
 
@@ -528,7 +528,7 @@ static unsigned int hci_uart_tty_poll(struct tty_struct *tty,
 
 static int __init hci_uart_init(void)
 {
-       static struct tty_ldisc hci_uart_ldisc;
+       static struct tty_ldisc_ops hci_uart_ldisc;
        int err;
 
        BT_INFO("HCI UART driver ver %s", VERSION);
@@ -544,7 +544,6 @@ static int __init hci_uart_init(void)
        hci_uart_ldisc.write            = hci_uart_tty_write;
        hci_uart_ldisc.ioctl            = hci_uart_tty_ioctl;
        hci_uart_ldisc.poll             = hci_uart_tty_poll;
-       hci_uart_ldisc.receive_room     = hci_uart_tty_room;
        hci_uart_ldisc.receive_buf      = hci_uart_tty_receive;
        hci_uart_ldisc.write_wakeup     = hci_uart_tty_wakeup;
        hci_uart_ldisc.owner            = THIS_MODULE;
@@ -560,7 +559,13 @@ static int __init hci_uart_init(void)
 #ifdef CONFIG_BT_HCIUART_BCSP
        bcsp_init();
 #endif
-       
+#ifdef CONFIG_BT_HCIUART_LL
+       ll_init();
+#endif
+#ifdef CONFIG_BT_HCIUART_ATH3K
+       ath_init();
+#endif
+
        return 0;
 }
 
@@ -574,6 +579,12 @@ static void __exit hci_uart_exit(void)
 #ifdef CONFIG_BT_HCIUART_BCSP
        bcsp_deinit();
 #endif
+#ifdef CONFIG_BT_HCIUART_LL
+       ll_deinit();
+#endif
+#ifdef CONFIG_BT_HCIUART_ATH3K
+       ath_deinit();
+#endif
 
        /* Release tty registration of line discipline */
        if ((err = tty_unregister_ldisc(N_HCI)))
@@ -586,7 +597,7 @@ module_exit(hci_uart_exit);
 module_param(reset, bool, 0644);
 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth HCI UART driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");