kernel/linux.git/drivers/bluetooth/hci_intel.c, branch v4.9.331

Bluetooth: hci_uart: check for missing tty operations

2019-08-04T07:33:44+00:00

commit b36a1552d7319bbfd5cf7f08726c23c5c66d4f73 upstream. Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset() functions which are called by the certain HCI UART protocols (hci_ath, hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control() or directly. This leads to an execution at NULL and can be triggered by an unprivileged user. Fix this by adding a helper function and a check for the missing tty operations in the protocols code. This fixes CVE-2019-10207. The Fixes: lines list commits where calls to tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART protocols. Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # v2.6.36+ Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip") Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov Signed-off-by: Marcel Holtmann Reviewed-by: Yu-Chen, Cho Tested-by: Yu-Chen, Cho Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

Bluetooth: hci_intel: add missing tty-device sanity check

2017-05-20T12:28:41+00:00

commit dcb9cfaa5ea9aa0ec08aeb92582ccfe3e4c719a9 upstream. Make sure to check the tty-device pointer before looking up the sibling platform device to avoid dereferencing a NULL-pointer when the tty is one end of a Unix98 pty. Fixes: 74cdad37cd24 ("Bluetooth: hci_intel: Add runtime PM support") Fixes: 1ab1f239bf17 ("Bluetooth: hci_intel: Add support for platform driver") Cc: Loic Poulain Signed-off-by: Johan Hovold Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman

Bluetooth: btusb, hci_intel: Fix wait_on_bit_timeout() return value checks

2016-09-19T18:19:34+00:00

wait_on_bit_timeout() returns one of the following three values: * 0 to indicate success. * -EINTR to indicate that a signal has been received; * -EAGAIN to indicate timeout; Make the wait_on_bit_timeout() callers check for these values. Signed-off-by: Bart Van Assche Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann

Bluetooth: hci_intel: Remove LPM enabling from setup procedure

2016-07-11T19:57:50+00:00

LPM can be enabled via a DDC write command at specific DDC ID. As any other DDC value, this is up to the DDC config file to include (or not) the low power mode configuration. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_intel: Fix null gpio desc pointer dereference

2016-05-02T17:29:31+00:00

gpiod_get_optional can return either ERR_PTR or NULL pointer. NULL case is not tested and then dereferenced later in desc_to_gpio. Fix this by using non optional version which returns ERR_PTR in any error case (this is not an optional gpio). Use the same non optional version for the host-wake gpio. Fixes: 765ea3abd116 ("Bluetooth: hci_intel: Retrieve host-wake IRQ") Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_intel: Fix a wrong comparison

2016-02-23T19:29:36+00:00

A return value of the intel_wait_booting() function compared with a constant ETIMEDOUT instead of -ETIMEDOUT. Signed-off-by: Anton Protopopov Signed-off-by: Marcel Holtmann

Bluetooth: btintel: Create common Intel Version Read function

2015-12-09T23:51:51+00:00

The Intel Version Read command is used to retrieve information about hardware and firmware version/revision of Intel Bluetooth controllers. This is an Intel generic command used in USB and UART drivers. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_intel: Use shorter timeout for HCI commands

2015-12-09T23:51:50+00:00

Use the standard HCI_CMD_TIMEOUT(1s) for HCI command instead of HCI_INIT_TIMEOUT(10s) which is not justified in these cases. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: Use new hci_skb_pkt_* wrappers for drivers

2015-11-19T16:50:27+00:00

The new hci_skb_pkt_* wrappers are mainly intented for drivers to require less knowledge about bt_cb(sbk) handling. So after converting the core packet handling, convert all drivers. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg

Bluetooth: hci_uart: Provide initial manufacturer information

2015-10-21T04:20:44+00:00

Provide an early indication about the manufacturer information so that it can be forwarded into monitor channel. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg