Bluetooth: hci_ldisc: fix NULL-pointer dereference on tty_close

[linux-flexiantxendom0.git] / drivers / bluetooth / hci_ldisc.c

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 76a1abb..8f3d6db 100644 (file)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -101,7 +101,7 @@ static inline void hci_uart_tx_complete(struct hci_uart *hu, int pkt_type)
                break;
 
        case HCI_SCODATA_PKT:
-               hdev->stat.cmd_tx++;
+               hdev->stat.sco_tx++;
                break;
        }
 }
@@ -210,7 +210,6 @@ static int hci_uart_close(struct hci_dev *hdev)
 static int hci_uart_send_frame(struct sk_buff *skb)
 {
        struct hci_dev* hdev = (struct hci_dev *) skb->dev;
-       struct tty_struct *tty;
        struct hci_uart *hu;
 
        if (!hdev) {
@@ -222,7 +221,6 @@ static int hci_uart_send_frame(struct sk_buff *skb)
                return -EBUSY;
 
        hu = (struct hci_uart *) hdev->driver_data;
-       tty = hu->tty;
 
        BT_DBG("%s: type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
@@ -239,7 +237,6 @@ static void hci_uart_destruct(struct hci_dev *hdev)
                return;
 
        BT_DBG("%s", hdev->name);
-       kfree(hdev->driver_data);
 }
 
 /* ------ LDISC part ------ */
@@ -258,9 +255,16 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
        BT_DBG("tty %p", tty);
 
+       /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
+          the pointer */
        if (hu)
                return -EEXIST;
 
+       /* Error if the tty has no write op instead of leaving an exploitable
+          hole */
+       if (tty->ops->write == NULL)
+               return -EOPNOTSUPP;
+
        if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
                BT_ERR("Can't allocate control structure");
                return -ENFILE;
@@ -305,10 +309,13 @@ static void hci_uart_tty_close(struct tty_struct *tty)
                        hci_uart_close(hdev);
 
                if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
+                       if (hdev) {
+                               hci_unregister_dev(hdev);
+                               hci_free_dev(hdev);
+                       }
                        hu->proto->close(hu);
-                       hci_unregister_dev(hdev);
-                       hci_free_dev(hdev);
                }
+               kfree(hu);
        }
 }
 
@@ -391,12 +398,16 @@ static int hci_uart_register_dev(struct hci_uart *hu)
        hdev->flush = hci_uart_flush;
        hdev->send  = hci_uart_send_frame;
        hdev->destruct = hci_uart_destruct;
+       hdev->parent = hu->tty->dev;
 
        hdev->owner = THIS_MODULE;
 
        if (!reset)
                set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
 
+       if (test_bit(HCI_UART_RAW_DEVICE, &hu->hdev_flags))
+               set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
+
        if (hci_register_dev(hdev) < 0) {
                BT_ERR("Can't register HCI device");
                hci_free_dev(hdev);
@@ -477,6 +488,15 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file * file,
                        return hu->hdev->id;
                return -EUNATCH;
 
+       case HCIUARTSETFLAGS:
+               if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+                       return -EBUSY;
+               hu->hdev_flags = arg;
+               break;
+
+       case HCIUARTGETFLAGS:
+               return hu->hdev_flags;
+
        default:
                err = n_tty_ioctl_helper(tty, file, cmd, arg);
                break;
@@ -542,6 +562,9 @@ static int __init hci_uart_init(void)
 #ifdef CONFIG_BT_HCIUART_LL
        ll_init();
 #endif
+#ifdef CONFIG_BT_HCIUART_ATH3K
+       ath_init();
+#endif
 
        return 0;
 }
@@ -559,6 +582,9 @@ static void __exit hci_uart_exit(void)
 #ifdef CONFIG_BT_HCIUART_LL
        ll_deinit();
 #endif
+#ifdef CONFIG_BT_HCIUART_ATH3K
+       ath_deinit();
+#endif
 
        /* Release tty registration of line discipline */
        if ((err = tty_unregister_ldisc(N_HCI)))