kernel/linux.git/drivers/bluetooth/hci_uart.h, branch v4.9.331

Bluetooth: hci_uart: check for missing tty operations

2019-08-04T07:33:44+00:00

commit b36a1552d7319bbfd5cf7f08726c23c5c66d4f73 upstream. Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset() functions which are called by the certain HCI UART protocols (hci_ath, hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control() or directly. This leads to an execution at NULL and can be triggered by an unprivileged user. Fix this by adding a helper function and a check for the missing tty operations in the protocols code. This fixes CVE-2019-10207. The Fixes: lines list commits where calls to tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART protocols. Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com Cc: stable@vger.kernel.org # v2.6.36+ Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip") Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov Signed-off-by: Marcel Holtmann Reviewed-by: Yu-Chen, Cho Tested-by: Yu-Chen, Cho Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

Bluetooth: hci_uart: Add Marvell support

2016-09-19T18:32:03+00:00

This patch introduces support for Marvell Bluetooth controller over UART (8897 for now). In order to send the final firmware at full speed, a helper firmware is firstly sent. Firmware download is driven by the controller which sends request firmware packets (including expected size). This driver is a global rework of the one proposed by Amitkumar Karwar . Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_uart: Add Nokia Protocol identifier

2016-09-19T18:25:37+00:00

Will be used by hci_nokia extra protocol. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_ldisc: Fix null pointer derefence in case of early data

2016-04-08T16:58:56+00:00

HCI_UART_PROTO_SET flag is set before hci_uart_set_proto call. If we receive data from tty layer during this procedure, proto pointer may not be assigned yet, leading to null pointer dereference in rx method hci_uart_tty_receive. This patch fixes this issue by introducing HCI_UART_PROTO_READY flag in order to avoid any proto operation before proto opening and assignment. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_uart: Add Intel/AG6xx support

2016-02-24T15:34:23+00:00

This driver implements support for iBT2.1 Bluetooth controller embedded in the AG620 communication combo. The controller needs to be configured with bddata and can be patched with a binary patch file (pbn). These operations are performed in manufacturing mode. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_uart: Provide initial manufacturer information

2015-10-21T04:20:44+00:00

Provide an early indication about the manufacturer information so that it can be forwarded into monitor channel. Signed-off-by: Marcel Holtmann Signed-off-by: Johan Hedberg

Bluetooth: Remove useless rx_lock spinlock

2015-09-24T14:25:44+00:00

rx_lock spinlock is only used in hci_uart_tty_receive() which is the receive_buf ldisc callback. hci_uart_tty_receive() is protected from re-entrance by its only caller (flush_to_ldisc() in drivers/tty/tty_buffer.c) which held a mutex (buf->lock) for this section. This lock allows "safe use of the line discipline's receive_buf() method by excluding the buffer work and any pending flush from using the flip buffer." (comments from tty_buffer_lock_exclusive() in drivers/tty/tty_buffer.c) So, no need to double protect this resource with rx_lock. Signed-off-by: Frederic Danis Signed-off-by: Marcel Holtmann

Bluetooth: hciuart: Add support QCA chipset for UART

2015-08-10T21:52:20+00:00

QCA61x4 chips have supported sleep feature using In-Band-Sleep commands to enable sleep feature based on H4 protocol. After sending patch/nvm configuration is done, IBS mode will be up and running Signed-off-by: Ben Young Tae Kim Signed-off-by: Marcel Holtmann

Bluetooth: hci_uart: Add basic support for Intel Lightning Peak devices

2015-07-23T15:10:49+00:00

The Intel Lightning Peak devices do not come with Bluetooth firmware loaded and thus require a full download of the operational Bluetooth firmware when the device is attached via the Bluetooth line discipline. Lightning Peak devices start with a bootloader mode that only accepts a very limited set of HCI commands. The supported commands are enough to identify the hardware and select the right firmware to load. Signed-off-by: Loic Poulain Signed-off-by: Marcel Holtmann

Bluetooth: hci_uart: Add new line discipline enhancements

2015-06-17T21:44:49+00:00

Added the ability to flow control the UART, improved the UART baud rate setting, transferred the speeds into line discipline from the protocol and introduced the tty init function. Signed-off-by: Ilya Faenson Signed-off-by: Marcel Holtmann