Lee, Chun-Yi 7732c54f2b Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO ...

commit 9c33663af9ad115f90c076a1828129a3fbadea98 upstream.

This patch adds code to check HCI_UART_PROTO_READY flag before
accessing hci_uart->proto. It fixes the race condition in
hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO.
This issue bug found by Yu Hao and Weiteng Chen:

BUG: general protection fault in hci_uart_tty_ioctl [1]

The information of C reproducer can also reference the link [2]

Reported-by: Yu Hao <yhao016@ucr.edu>
Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDeCO2g@mail.gmail.com/ [1]
Reported-by: Weiteng Chen <wchen130@ucr.edu>
Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4Keh2ow@mail.gmail.com/T/ [2]
Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2024-09-04 13:15:01 +02:00

..

ath3k.c

Bluetooth: ath3k: Fix multiple issues reported by checkpatch.pl

2024-07-05 09:08:21 +02:00

bcm203x.c

…

bfusb.c

Bluetooth: bfusb: fix division by zero in send path

2022-01-16 09:15:38 +01:00

bluecard_cs.c

…

bpa10x.c

…

bt3c_cs.c

…

btbcm.c

Bluetooth: btbcm: Add 2 missing models to subver tables

2020-06-22 09:30:59 +02:00

btbcm.h

…

btintel.c

Bluetooth: btintel: Fixe build regression

2024-04-13 12:51:40 +02:00

btintel.h

…

btmrvl_debugfs.c

…

btmrvl_drv.h

…

btmrvl_main.c

…

btmrvl_sdio.c

btmrvl: Fix firmware filename for sd8997 chipset

2020-08-19 08:16:06 +02:00

btmrvl_sdio.h

…

btmtksdio.c

Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt

2022-04-15 14:18:16 +02:00

btmtkuart.c

Bluetooth: btmtkuart: fix recv_buf() return value

2024-01-25 14:34:26 -08:00

btqca.c

…

btqca.h

…

btqcomsmd.c

Bluetooth: btqcomsmd: Fix command timeout after setting BD address

2023-04-05 11:16:38 +02:00

btrsi.c

…

btrtl.c

Bluetooth: btrtl: Use kvmalloc for FW allocations

2020-10-01 13:17:29 +02:00

btrtl.h

…

btsdio.c

Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

2023-09-23 10:59:37 +02:00

btusb.c

Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x13d3:0x3591

2024-08-19 05:33:40 +02:00

btwilink.c

…

dtl1_cs.c

…

h4_recv.h

…

hci_ag6xx.c

…

hci_ath.c

…

hci_bcm.c

Bluetooth: hci_bcm: Check for error irq

2022-01-27 09:19:36 +01:00

hci_bcsp.c

Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:41:16 +01:00

hci_h4.c

…

hci_h5.c

Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:41:16 +01:00

hci_intel.c

Bluetooth: hci_intel: Add check for platform_driver_register

2022-08-25 11:17:47 +02:00

hci_ldisc.c

Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO

2024-09-04 13:15:01 +02:00

hci_ll.c

Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:41:16 +01:00

hci_mrvl.c

…

hci_nokia.c

Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()

2023-09-23 10:59:42 +02:00

hci_qca.c

Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()

2023-01-18 11:41:16 +01:00

hci_serdev.c

Bluetooth: hci_serdev: call init_rwsem() before p->open()

2022-04-15 14:18:10 +02:00

hci_uart.h

…

hci_vhci.c

Bluetooth: vhci: Fix race when opening vhci device

2023-10-25 11:53:20 +02:00

Kconfig

…

Makefile

…