mirror of https://github.com/torvalds/linux.git
ca94b2b036
Currently, bcsp_recv() can be called even when the BCSP protocol has not
been registered. This leads to a NULL pointer dereference, as shown in
the following stack trace:
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
Call Trace:
<TASK>
hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
processing received data. If the protocol is not registered, return
-EUNATCH.
Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| ath3k.c | ||
| bcm203x.c | ||
| bfusb.c | ||
| bluecard_cs.c | ||
| bpa10x.c | ||
| bt3c_cs.c | ||
| btbcm.c | ||
| btbcm.h | ||
| btintel.c | ||
| btintel.h | ||
| btintel_pcie.c | ||
| btintel_pcie.h | ||
| btmrvl_debugfs.c | ||
| btmrvl_drv.h | ||
| btmrvl_main.c | ||
| btmrvl_sdio.c | ||
| btmrvl_sdio.h | ||
| btmtk.c | ||
| btmtk.h | ||
| btmtksdio.c | ||
| btmtkuart.c | ||
| btnxpuart.c | ||
| btqca.c | ||
| btqca.h | ||
| btqcomsmd.c | ||
| btrsi.c | ||
| btrtl.c | ||
| btrtl.h | ||
| btsdio.c | ||
| btusb.c | ||
| dtl1_cs.c | ||
| hci_ag6xx.c | ||
| hci_aml.c | ||
| hci_ath.c | ||
| hci_bcm.c | ||
| hci_bcm4377.c | ||
| hci_bcsp.c | ||
| hci_h4.c | ||
| hci_h5.c | ||
| hci_intel.c | ||
| hci_ldisc.c | ||
| hci_ll.c | ||
| hci_mrvl.c | ||
| hci_nokia.c | ||
| hci_qca.c | ||
| hci_serdev.c | ||
| hci_uart.h | ||
| hci_vhci.c | ||
| virtio_bt.c | ||