linux/drivers/bluetooth
David Newall 3611f4d2a5 hci_ldisc: fix null pointer deref
Arjan:

  With the help of kerneloops.org I've spotted a nice little interaction
  between the TTY layer and the bluetooth code, however the tty layer is not
  something I'm all too familiar with so I rather ask than brute-force fix the
  code incorrectly.

  The raw details are at:
  http://www.kerneloops.org/search.php?search=uart_flush_buffer

  What happens is that, on closing the bluetooth tty, the tty layer goes
  into the release_dev() function, which first does a bunch of stuff, then
  sets the file->private_data to NULL, does some more stuff and then calls the
  ldisc close function.  Which in this case, is hci_uart_tty_close().

  Now, hci_uart_tty_close() calls hci_uart_close() which clears some
  internal bit, and then calls hci_uart_flush()...  which calls back to the
  tty layers' uart_flush_buffer() function.  (in drivers/bluetooth/hci_tty.c
  around line 194) Which then WARN_ON()'s because that's not allowed/supposed
  to be called this late in the shutdown of the port....

  Should the bluetooth driver even call this flush function at all??

David:

  This seems to be what happens: Hci_uart_close() flushes using
  hci_uart_flush().  Subsequently, in hci_dev_do_close(), (one step in
  hci_unregister_dev()), hci_uart_flush() is called again.  The comment in
  uart_flush_buffer(), relating to the WARN_ON(), indicates you can't flush
  after the port is closed; which sounds reasonable.  I think hci_uart_close()
  should set hdev->flush to NULL before returning.  Hci_dev_do_close() does
  check for this.  The code path is rather involved and I'm not entirely clear
  of all steps, but I think that's what should be done.

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2008-02-12 17:54:16 -08:00
..
Kconfig [Bluetooth] Add generic driver for Bluetooth USB devices 2007-10-22 02:59:46 -07:00
Makefile [Bluetooth] Add generic driver for Bluetooth USB devices 2007-10-22 02:59:46 -07:00
bcm203x.c [Bluetooth] Make use of MODULE_FIRMWARE 2007-02-26 11:42:42 -08:00
bfusb.c [SK_BUFF]: Introduce skb_copy_from_linear_data{_offset} 2007-04-25 22:28:23 -07:00
bluecard_cs.c [Bluetooth] Eliminate checks for impossible conditions in IRQ handler 2007-10-22 02:59:44 -07:00
bpa10x.c drivers/bluetooth/bpa10x.c: fix memleak 2008-02-05 03:08:45 -08:00
bt3c_cs.c pcmcia: replace kio_addr_t with unsigned int everywhere 2008-02-05 09:44:08 -08:00
btsdio.c drivers/bluetooth/btsdio.c: fix double-free 2008-02-05 03:09:17 -08:00
btuart_cs.c pcmcia: replace kio_addr_t with unsigned int everywhere 2008-02-05 09:44:08 -08:00
btusb.c [Bluetooth] Add generic driver for Bluetooth USB devices 2007-10-22 02:59:46 -07:00
dtl1_cs.c [Bluetooth] Eliminate checks for impossible conditions in IRQ handler 2007-10-22 02:59:44 -07:00
hci_bcsp.c [Bluetooth] Switch from OGF+OCF to using only opcodes 2007-10-22 02:59:40 -07:00
hci_h4.c [BLUETOOTH]: Introduce skb->data accessor methods for hci_{acl,event,sco}_hdr 2007-04-25 22:28:21 -07:00
hci_ldisc.c hci_ldisc: fix null pointer deref 2008-02-12 17:54:16 -08:00
hci_ll.c [BLUETOOTH]: Always send explicit hci_ll wake-up acks. 2008-01-10 22:24:43 -08:00
hci_uart.h [Bluetooth] Add UART driver for Texas Instruments' BRF63xx chips 2007-10-22 02:59:44 -07:00
hci_usb.c bluetooth: blacklist another Broadcom BCM2035 device 2008-02-05 03:10:02 -08:00
hci_usb.h [Bluetooth] Use hci_recv_fragment() within HCI USB driver 2007-07-11 06:42:35 +02:00
hci_vhci.c [Bluetooth] Remove the redundant non-seekable llseek method 2007-07-11 06:53:45 +02:00