Skip to content

Commit b489556

Browse files
jcalvinowensVudentz
jcalvinowens
authored and
Vudentz
committed
Bluetooth: fix corruption in h4_recv_buf() after cleanup
A different structure is stored in drvdata for the drivers which used that duplicate function, but h4_recv_buf() assumes drvdata is always an hci_uart structure. Consequently, alignment and padding are now randomly corrupted for btmtkuart, btnxpuart, and bpa10x in h4_recv_buf(), causing erratic breakage. Fix this by making the hci_uart structure the explicit argument to h4_recv_buf(). Every caller already has a reference to hci_uart, and already obtains the hci_hdev reference through it, so this actually eliminates a redundant pointer indirection for all existing callers. Fixes: 93f06f8 ("Bluetooth: remove duplicate h4_recv_buf() in header") Reported-by: Francesco Valla <francesco@valla.it> Closes: https://lore.kernel.org/lkml/6837167.ZASKD2KPVS@fedora.fritz.box/ Signed-off-by: Calvin Owens <calvin@wbinvd.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
1 parent 057b6ca commit b489556

14 files changed

Lines changed: 25 additions & 19 deletions

File tree

‎drivers/bluetooth/bpa10x.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ struct bpa10x_data {
4141
struct usb_anchor rx_anchor;
4242

4343
struct sk_buff *rx_skb[2];
44+
struct hci_uart hu;
4445
};
4546

4647
static void bpa10x_tx_complete(struct urb *urb)
@@ -96,7 +97,7 @@ static void bpa10x_rx_complete(struct urb *urb)
9697
if (urb->status == 0) {
9798
bool idx = usb_pipebulk(urb->pipe);
9899

99-
data->rx_skb[idx] = h4_recv_buf(hdev, data->rx_skb[idx],
100+
data->rx_skb[idx] = h4_recv_buf(&data->hu, data->rx_skb[idx],
100101
urb->transfer_buffer,
101102
urb->actual_length,
102103
bpa10x_recv_pkts,
@@ -388,6 +389,7 @@ static int bpa10x_probe(struct usb_interface *intf,
388389
hci_set_drvdata(hdev, data);
389390

390391
data->hdev = hdev;
392+
data->hu.hdev = hdev;
391393

392394
SET_HCIDEV_DEV(hdev, &intf->dev);
393395

‎drivers/bluetooth/btmtkuart.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ struct btmtkuart_dev {
7979
u16 stp_dlen;
8080

8181
const struct btmtkuart_data *data;
82+
struct hci_uart hu;
8283
};
8384

8485
#define btmtkuart_is_standalone(bdev) \
@@ -368,7 +369,7 @@ static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
368369
sz_left -= adv;
369370
p_left += adv;
370371

371-
bdev->rx_skb = h4_recv_buf(bdev->hdev, bdev->rx_skb, p_h4,
372+
bdev->rx_skb = h4_recv_buf(&bdev->hu, bdev->rx_skb, p_h4,
372373
sz_h4, mtk_recv_pkts,
373374
ARRAY_SIZE(mtk_recv_pkts));
374375
if (IS_ERR(bdev->rx_skb)) {
@@ -858,6 +859,7 @@ static int btmtkuart_probe(struct serdev_device *serdev)
858859
}
859860

860861
bdev->hdev = hdev;
862+
bdev->hu.hdev = hdev;
861863

862864
hdev->bus = HCI_UART;
863865
hci_set_drvdata(hdev, bdev);

‎drivers/bluetooth/btnxpuart.c‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,7 @@ struct btnxpuart_dev {
212212
struct ps_data psdata;
213213
struct btnxpuart_data *nxp_data;
214214
struct reset_control *pdn;
215+
struct hci_uart hu;
215216
};
216217

217218
#define NXP_V1_FW_REQ_PKT 0xa5
@@ -1756,7 +1757,7 @@ static size_t btnxpuart_receive_buf(struct serdev_device *serdev,
17561757

17571758
ps_start_timer(nxpdev);
17581759

1759-
nxpdev->rx_skb = h4_recv_buf(nxpdev->hdev, nxpdev->rx_skb, data, count,
1760+
nxpdev->rx_skb = h4_recv_buf(&nxpdev->hu, nxpdev->rx_skb, data, count,
17601761
nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
17611762
if (IS_ERR(nxpdev->rx_skb)) {
17621763
int err = PTR_ERR(nxpdev->rx_skb);
@@ -1875,6 +1876,7 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
18751876
reset_control_deassert(nxpdev->pdn);
18761877

18771878
nxpdev->hdev = hdev;
1879+
nxpdev->hu.hdev = hdev;
18781880

18791881
hdev->bus = HCI_UART;
18801882
hci_set_drvdata(hdev, nxpdev);

‎drivers/bluetooth/hci_ag6xx.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ static int ag6xx_recv(struct hci_uart *hu, const void *data, int count)
105105
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
106106
return -EUNATCH;
107107

108-
ag6xx->rx_skb = h4_recv_buf(hu->hdev, ag6xx->rx_skb, data, count,
108+
ag6xx->rx_skb = h4_recv_buf(hu, ag6xx->rx_skb, data, count,
109109
ag6xx_recv_pkts,
110110
ARRAY_SIZE(ag6xx_recv_pkts));
111111
if (IS_ERR(ag6xx->rx_skb)) {

‎drivers/bluetooth/hci_aml.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -650,7 +650,7 @@ static int aml_recv(struct hci_uart *hu, const void *data, int count)
650650
struct aml_data *aml_data = hu->priv;
651651
int err;
652652

653-
aml_data->rx_skb = h4_recv_buf(hu->hdev, aml_data->rx_skb, data, count,
653+
aml_data->rx_skb = h4_recv_buf(hu, aml_data->rx_skb, data, count,
654654
aml_recv_pkts,
655655
ARRAY_SIZE(aml_recv_pkts));
656656
if (IS_ERR(aml_data->rx_skb)) {

‎drivers/bluetooth/hci_ath.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,7 @@ static int ath_recv(struct hci_uart *hu, const void *data, int count)
191191
{
192192
struct ath_struct *ath = hu->priv;
193193

194-
ath->rx_skb = h4_recv_buf(hu->hdev, ath->rx_skb, data, count,
194+
ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count,
195195
ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts));
196196
if (IS_ERR(ath->rx_skb)) {
197197
int err = PTR_ERR(ath->rx_skb);

‎drivers/bluetooth/hci_bcm.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -698,7 +698,7 @@ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
698698
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
699699
return -EUNATCH;
700700

701-
bcm->rx_skb = h4_recv_buf(hu->hdev, bcm->rx_skb, data, count,
701+
bcm->rx_skb = h4_recv_buf(hu, bcm->rx_skb, data, count,
702702
bcm_recv_pkts, ARRAY_SIZE(bcm_recv_pkts));
703703
if (IS_ERR(bcm->rx_skb)) {
704704
int err = PTR_ERR(bcm->rx_skb);

‎drivers/bluetooth/hci_h4.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ static int h4_recv(struct hci_uart *hu, const void *data, int count)
112112
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
113113
return -EUNATCH;
114114

115-
h4->rx_skb = h4_recv_buf(hu->hdev, h4->rx_skb, data, count,
115+
h4->rx_skb = h4_recv_buf(hu, h4->rx_skb, data, count,
116116
h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts));
117117
if (IS_ERR(h4->rx_skb)) {
118118
int err = PTR_ERR(h4->rx_skb);
@@ -151,12 +151,12 @@ int __exit h4_deinit(void)
151151
return hci_uart_unregister_proto(&h4p);
152152
}
153153

154-
struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
154+
struct sk_buff *h4_recv_buf(struct hci_uart *hu, struct sk_buff *skb,
155155
const unsigned char *buffer, int count,
156156
const struct h4_recv_pkt *pkts, int pkts_count)
157157
{
158-
struct hci_uart *hu = hci_get_drvdata(hdev);
159158
u8 alignment = hu->alignment ? hu->alignment : 1;
159+
struct hci_dev *hdev = hu->hdev;
160160

161161
/* Check for error from previous call */
162162
if (IS_ERR(skb))

‎drivers/bluetooth/hci_intel.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -972,7 +972,7 @@ static int intel_recv(struct hci_uart *hu, const void *data, int count)
972972
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
973973
return -EUNATCH;
974974

975-
intel->rx_skb = h4_recv_buf(hu->hdev, intel->rx_skb, data, count,
975+
intel->rx_skb = h4_recv_buf(hu, intel->rx_skb, data, count,
976976
intel_recv_pkts,
977977
ARRAY_SIZE(intel_recv_pkts));
978978
if (IS_ERR(intel->rx_skb)) {

‎drivers/bluetooth/hci_ll.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -429,7 +429,7 @@ static int ll_recv(struct hci_uart *hu, const void *data, int count)
429429
if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
430430
return -EUNATCH;
431431

432-
ll->rx_skb = h4_recv_buf(hu->hdev, ll->rx_skb, data, count,
432+
ll->rx_skb = h4_recv_buf(hu, ll->rx_skb, data, count,
433433
ll_recv_pkts, ARRAY_SIZE(ll_recv_pkts));
434434
if (IS_ERR(ll->rx_skb)) {
435435
int err = PTR_ERR(ll->rx_skb);

0 commit comments

Comments
 (0)