Bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close

[linux-flexiantxendom0.git] / drivers / bluetooth / hci_ldisc.c

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 69df187..8f3d6db 100644 (file)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -46,11 +46,6 @@
 
 #include "hci_uart.h"
 
-#ifndef CONFIG_BT_HCIUART_DEBUG
-#undef  BT_DBG
-#define BT_DBG( A... )
-#endif
-
 #define VERSION "2.2"
 
 static int reset = 0;
@@ -106,7 +101,7 @@ static inline void hci_uart_tx_complete(struct hci_uart *hu, int pkt_type)
                break;
 
        case HCI_SCODATA_PKT:
-               hdev->stat.cmd_tx++;
+               hdev->stat.sco_tx++;
                break;
        }
 }
@@ -215,11 +210,10 @@ static int hci_uart_close(struct hci_dev *hdev)
 static int hci_uart_send_frame(struct sk_buff *skb)
 {
        struct hci_dev* hdev = (struct hci_dev *) skb->dev;
-       struct tty_struct *tty;
        struct hci_uart *hu;
 
        if (!hdev) {
-               BT_ERR("Frame for uknown device (hdev=NULL)");
+               BT_ERR("Frame for unknown device (hdev=NULL)");
                return -ENODEV;
        }
 
@@ -227,7 +221,6 @@ static int hci_uart_send_frame(struct sk_buff *skb)
                return -EBUSY;
 
        hu = (struct hci_uart *) hdev->driver_data;
-       tty = hu->tty;
 
        BT_DBG("%s: type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
@@ -244,7 +237,6 @@ static void hci_uart_destruct(struct hci_dev *hdev)
                return;
 
        BT_DBG("%s", hdev->name);
-       kfree(hdev->driver_data);
 }
 
 /* ------ LDISC part ------ */
@@ -263,9 +255,16 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
        BT_DBG("tty %p", tty);
 
+       /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
+          the pointer */
        if (hu)
                return -EEXIST;
 
+       /* Error if the tty has no write op instead of leaving an exploitable
+          hole */
+       if (tty->ops->write == NULL)
+               return -EOPNOTSUPP;
+
        if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
                BT_ERR("Can't allocate control structure");
                return -ENFILE;
@@ -282,8 +281,8 @@ static int hci_uart_tty_open(struct tty_struct *tty)
        /* FIXME: why is this needed. Note don't use ldisc_ref here as the
           open path is before the ldisc is referencable */
 
-       if (tty->ldisc.ops->flush_buffer)
-               tty->ldisc.ops->flush_buffer(tty);
+       if (tty->ldisc->ops->flush_buffer)
+               tty->ldisc->ops->flush_buffer(tty);
        tty_driver_flush_buffer(tty);
 
        return 0;
@@ -310,10 +309,13 @@ static void hci_uart_tty_close(struct tty_struct *tty)
                        hci_uart_close(hdev);
 
                if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
+                       if (hdev) {
+                               hci_unregister_dev(hdev);
+                               hci_free_dev(hdev);
+                       }
                        hu->proto->close(hu);
-                       hci_unregister_dev(hdev);
-                       hci_free_dev(hdev);
                }
+               kfree(hu);
        }
 }
 
@@ -388,7 +390,7 @@ static int hci_uart_register_dev(struct hci_uart *hu)
 
        hu->hdev = hdev;
 
-       hdev->type = HCI_UART;
+       hdev->bus = HCI_UART;
        hdev->driver_data = hu;
 
        hdev->open  = hci_uart_open;
@@ -396,11 +398,15 @@ static int hci_uart_register_dev(struct hci_uart *hu)
        hdev->flush = hci_uart_flush;
        hdev->send  = hci_uart_send_frame;
        hdev->destruct = hci_uart_destruct;
+       hdev->parent = hu->tty->dev;
 
        hdev->owner = THIS_MODULE;
 
-       if (reset)
-               set_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks);
+       if (!reset)
+               set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
+
+       if (test_bit(HCI_UART_RAW_DEVICE, &hu->hdev_flags))
+               set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 
        if (hci_register_dev(hdev) < 0) {
                BT_ERR("Can't register HCI device");
@@ -468,7 +474,6 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file * file,
                                clear_bit(HCI_UART_PROTO_SET, &hu->flags);
                                return err;
                        }
-                       tty->low_latency = 1;
                } else
                        return -EBUSY;
                break;
@@ -483,8 +488,17 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file * file,
                        return hu->hdev->id;
                return -EUNATCH;
 
+       case HCIUARTSETFLAGS:
+               if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+                       return -EBUSY;
+               hu->hdev_flags = arg;
+               break;
+
+       case HCIUARTGETFLAGS:
+               return hu->hdev_flags;
+
        default:
-               err = n_tty_ioctl(tty, file, cmd, arg);
+               err = n_tty_ioctl_helper(tty, file, cmd, arg);
                break;
        };
 
@@ -548,6 +562,9 @@ static int __init hci_uart_init(void)
 #ifdef CONFIG_BT_HCIUART_LL
        ll_init();
 #endif
+#ifdef CONFIG_BT_HCIUART_ATH3K
+       ath_init();
+#endif
 
        return 0;
 }
@@ -565,6 +582,9 @@ static void __exit hci_uart_exit(void)
 #ifdef CONFIG_BT_HCIUART_LL
        ll_deinit();
 #endif
+#ifdef CONFIG_BT_HCIUART_ATH3K
+       ath_deinit();
+#endif
 
        /* Release tty registration of line discipline */
        if ((err = tty_unregister_ldisc(N_HCI)))
@@ -577,7 +597,7 @@ module_exit(hci_uart_exit);
 module_param(reset, bool, 0644);
 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
 
-MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>");
+MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth HCI UART driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");