tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

When a fault is injected during hci_uart line discipline setup, the
proto open() callback may fail leaving hu->priv as NULL. A subsequent
TIOCSTI ioctl can trigger the recv() callback before priv is
initialized, causing a NULL pointer dereference.

Fix all four affected HCI UART protocol drivers by adding a NULL check
on hu->priv at the start of their recv() callbacks: h4, h5, ath and
bcsp.

Reported-by: syzbot+ff30eeab8e07b37d524e@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ff30eeab8e07b37d524e
Signed-off-by: Aurelien DESBRIERES <aurelien@hackers.camp>
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

authored by

Aurelien DESBRIERES and committed by
Luiz Augusto von Dentz 902fe40b 5917dd39

+12
+3
drivers/bluetooth/hci_ath.c
··· 191 191 { 192 192 struct ath_struct *ath = hu->priv; 193 193 194 + if (!ath) 195 + return -ENODEV; 196 + 194 197 ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count, 195 198 ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts)); 196 199 if (IS_ERR(ath->rx_skb)) {
+3
drivers/bluetooth/hci_bcsp.c
··· 585 585 if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) 586 586 return -EUNATCH; 587 587 588 + if (!bcsp) 589 + return -ENODEV; 590 + 588 591 BT_DBG("hu %p count %d rx_state %d rx_count %ld", 589 592 hu, count, bcsp->rx_state, bcsp->rx_count); 590 593
+3
drivers/bluetooth/hci_h4.c
··· 109 109 { 110 110 struct h4_struct *h4 = hu->priv; 111 111 112 + if (!h4) 113 + return -ENODEV; 114 + 112 115 h4->rx_skb = h4_recv_buf(hu, h4->rx_skb, data, count, 113 116 h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts)); 114 117 if (IS_ERR(h4->rx_skb)) {
+3
drivers/bluetooth/hci_h5.c
··· 587 587 struct h5 *h5 = hu->priv; 588 588 const unsigned char *ptr = data; 589 589 590 + if (!h5) 591 + return -ENODEV; 592 + 590 593 BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending, 591 594 count); 592 595