linux-toradex.git/drivers/bluetooth/hci_ath.c, branch v5.5

Bluetooth: hci_uart: check for missing tty operations

2019-07-31T20:17:33+00:00

Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset()
functions which are called by the certain HCI UART protocols (hci_ath,
hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control()
or directly. This leads to an execution at NULL and can be triggered by
an unprivileged user. Fix this by adding a helper function and a check
for the missing tty operations in the protocols code.

This fixes CVE-2019-10207. The Fixes: lines list commits where calls to
tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART
protocols.

Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50
Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org # v2.6.36+
Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip")
Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions")
Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support")
Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support")
Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990")
Signed-off-by: Vladis Dronov 
Signed-off-by: Marcel Holtmann 
Reviewed-by: Yu-Chen, Cho 
Tested-by: Yu-Chen, Cho 
Signed-off-by: Linus Torvalds

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156

2019-05-30T18:26:35+00:00

Based on 1 normalized pattern(s):

  this program is free software you can redistribute it and or modify
  it under the terms of the gnu general public license as published by
  the free software foundation either version 2 of the license or at
  your option any later version this program is distributed in the
  hope that it will be useful but without any warranty without even
  the implied warranty of merchantability or fitness for a particular
  purpose see the gnu general public license for more details you
  should have received a copy of the gnu general public license along
  with this program if not write to the free software foundation inc
  59 temple place suite 330 boston ma 02111 1307 usa

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-or-later

has been chosen to replace the boilerplate/reference in 1334 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Allison Randal 
Reviewed-by: Richard Fontana 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070033.113240726@linutronix.de
Signed-off-by: Greg Kroah-Hartman

Bluetooth: hci_ath: Replace mdelay with msleep in ath_wakeup_ar3k

2018-02-07T08:47:04+00:00

ath_wakeup_ar3k() is never called from atomic context.

It is only called by ath_hci_uart_work() that is only called in
ath_open() via INIT_WORK().
All of the above functions do not enter atomic context along the way.

Despite never getting called from atomic context, ath_wakeup_ar3k() calls
mdelay() for busy wait.
That is not necessary and can be replaced with msleep to avoid busy wait.

This is found by a static analysis tool named DCNS written by myself.

Signed-off-by: Jia-Ju Bai 
Signed-off-by: Marcel Holtmann

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2017-10-30T10:25:45+00:00

In case of using BT_ERR and BT_INFO, convert to bt_dev_err and
bt_dev_info when possible. This allows for controller specific
reporting.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: hci_ath: Add ath_vendor_cmd helper

2017-10-29T13:08:56+00:00

Introduce ath_vendor_cmd function which can be used to
configure 'tags' and patch the firmware.

ATH vendor command has the following format:
| OPCODE (u8) | INDEX (LE16) | DLEN (U8) | DATA (U8 * DLEN) |

BD address configuration tag is at index 0x0001.

Signed-off-by: Loic Poulain 
Signed-off-by: Marcel Holtmann

Bluetooth: Use new hci_skb_pkt_* wrappers for drivers

2015-11-19T16:50:27+00:00

The new hci_skb_pkt_* wrappers are mainly intented for drivers to
require less knowledge about bt_cb(sbk) handling. So after converting
the core packet handling, convert all drivers.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: hci_uart: Provide initial manufacturer information

2015-10-21T04:20:44+00:00

Provide an early indication about the manufacturer information so that
it can be forwarded into monitor channel.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: hci_uart: Fix dereferencing of ERR_PTR

2015-06-17T12:21:08+00:00

If h4_recv_buf() return ERR_PTR instead sk_buff pointer, it should be
cleared once PTR_ERR is completed for the further dereference such as
h4_recv(), or h4_close().

Signed-off-by: Chan-yeol Park 
Signed-off-by: Marcel Holtmann

Bluetooth: hci_uart: Add Atheros support for address configuration

2015-04-29T23:05:29+00:00

The Atheros support for missing the support for configuration of the
Bluetooth public address. Add support for the vendor specific command.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg

Bluetooth: hci_uart: Reorder Atheros specific driver callbacks

2015-04-29T23:05:29+00:00

The driver callbacks in the Atheros support were all in a random order
and did not help readability of this driver. So reorder them to make
them aligned with what other Bluetooth UART drivers do. This patch is
not changing any actual code.

Signed-off-by: Marcel Holtmann 
Signed-off-by: Johan Hedberg