From c2578202919ace314908306346b99796d46aab64 Mon Sep 17 00:00:00 2001 From: Chan-yeol Park Date: Tue, 2 Apr 2013 21:24:21 +0900 Subject: Bluetooth: Fix H4 crash from incoming UART packets This patch adds a check HCI_UART_REGISTERED before reading UART data in the HCI UART H4 driver. UART data could arrive when inside the hci_uart_tty_ioctl function after calling test_and_set_bit for HCI_UART_PROTO_SET but before the hci_uart_set_proto function has returned. Backtrace: [] (hci_recv_stream_fragment+0x0/0x74) from [] (h4_recv+0x18/0x40) r7:eb1d4d1c r6:eb7683b0 r5:eae8e800 r4:0000000c [] (h4_recv+0x0/0x40) from [] (hci_uart_tty_receive+0x6c/0x94) r5:eae8e800 r4:eb768380 [] (hci_uart_tty_receive+0x0/0x94) from [] (flush_to_ldisc+0x16c/0x17c) r6:eae8e8d8 r5:eae8e800 r4:eae8e8c8 [] (flush_to_ldisc+0x0/0x17c) from [] (process_one_work+0x144/0x4d4) [] (process_one_work+0x0/0x4d4) from [] (worker_thread+0x180/0x370) [] (worker_thread+0x0/0x370) from [] (kthread+0x90/0x9c) [] (kthread+0x0/0x9c) from [] (do_exit+0x0/0x7ec) Signed-off-by: Chan-yeol Park Signed-off-by: Johan Hedberg --- drivers/bluetooth/hci_h4.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c index c60623f206d4..8ae9f1ea2bb5 100644 --- a/drivers/bluetooth/hci_h4.c +++ b/drivers/bluetooth/hci_h4.c @@ -153,6 +153,9 @@ static int h4_recv(struct hci_uart *hu, void *data, int count) { int ret; + if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) + return -EUNATCH; + ret = hci_recv_stream_fragment(hu->hdev, data, count); if (ret < 0) { BT_ERR("Frame Reassembly Failed"); -- cgit v1.2.3