diff mbox series

[3/3] Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown

Message ID 20240731-hci_qca_fixes-v1-3-59dad830b243@linaro.org
State New
Headers show
Series Bluetooth: hci_qca: fix post merge window regressions | expand

Commit Message

Bartosz Golaszewski July 31, 2024, 3:20 p.m. UTC 
From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Unlike qca_regulator_init(), qca_power_shutdown() may be called for
QCA_ROME which does not have qcadev->bt_power assigned. Add a
NULL-pointer check before dereferencing the struct qca_power pointer.

Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
---
 drivers/bluetooth/hci_qca.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Bartosz Golaszewski Aug. 7, 2024, 7:53 a.m. UTC | #1 
On Wed, Aug 7, 2024 at 12:44 AM Nícolas F. R. A. Prado
<nfraprado@collabora.com> wrote:
>
> On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> >
> > Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> > QCA_ROME which does not have qcadev->bt_power assigned. Add a
> > NULL-pointer check before dereferencing the struct qca_power pointer.
> >
> > Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
>
> Hi,
>
> I just noticed we're still hitting this issue in mainline (saw it on the
> mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
> bluetooth-next, but it seems there wasn't a pull request with this fix yet to
> include it in 6.11. I'm wondering if it's still going to be sent.
>
> Thanks,
> Nícolas

The patches are in next so I don't see why they wouldn't be sent upstream.

Moving Luiz and Marcel to To: to make sure they see this message.

Bart
Luiz Augusto von Dentz Aug. 7, 2024, 3:03 p.m. UTC | #2 
Hi Bartosz, Nicolas,

On Wed, Aug 7, 2024 at 3:53 AM Bartosz Golaszewski <brgl@bgdev.pl> wrote:
>
> On Wed, Aug 7, 2024 at 12:44 AM Nícolas F. R. A. Prado
> <nfraprado@collabora.com> wrote:
> >
> > On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> > > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > >
> > > Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> > > QCA_ROME which does not have qcadev->bt_power assigned. Add a
> > > NULL-pointer check before dereferencing the struct qca_power pointer.
> > >
> > > Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> > > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > > Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> > > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> >
> > Hi,
> >
> > I just noticed we're still hitting this issue in mainline (saw it on the
> > mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
> > bluetooth-next, but it seems there wasn't a pull request with this fix yet to
> > include it in 6.11. I'm wondering if it's still going to be sent.
> >
> > Thanks,
> > Nícolas
>
> The patches are in next so I don't see why they wouldn't be sent upstream.
>
> Moving Luiz and Marcel to To: to make sure they see this message.

I was on a business trip last week, will prepare the pull request later today.
Nícolas F. R. A. Prado Aug. 7, 2024, 6:34 p.m. UTC | #3 
On Wed, Aug 07, 2024 at 11:03:09AM -0400, Luiz Augusto von Dentz wrote:
> Hi Bartosz, Nicolas,
> 
> On Wed, Aug 7, 2024 at 3:53 AM Bartosz Golaszewski <brgl@bgdev.pl> wrote:
> >
> > On Wed, Aug 7, 2024 at 12:44 AM Nícolas F. R. A. Prado
> > <nfraprado@collabora.com> wrote:
> > >
> > > On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> > > > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > > >
> > > > Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> > > > QCA_ROME which does not have qcadev->bt_power assigned. Add a
> > > > NULL-pointer check before dereferencing the struct qca_power pointer.
> > > >
> > > > Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> > > > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > > > Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> > > > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > >
> > > Hi,
> > >
> > > I just noticed we're still hitting this issue in mainline (saw it on the
> > > mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
> > > bluetooth-next, but it seems there wasn't a pull request with this fix yet to
> > > include it in 6.11. I'm wondering if it's still going to be sent.
> > >
> > > Thanks,
> > > Nícolas
> >
> > The patches are in next so I don't see why they wouldn't be sent upstream.
> >
> > Moving Luiz and Marcel to To: to make sure they see this message.
> 
> I was on a business trip last week, will prepare the pull request later today.

Sounds good. And sorry for bothering you about this, I just wanted to make sure
the fix was headed to 6.11.

Thanks,
Nícolas
diff mbox series

Patch

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 2baed7d0f479..45adc1560d94 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -2160,7 +2160,7 @@  static void qca_power_shutdown(struct hci_uart *hu)
 	qcadev = serdev_device_get_drvdata(hu->serdev);
 	power = qcadev->bt_power;
 
-	if (power->pwrseq) {
+	if (power && power->pwrseq) {
 		pwrseq_power_off(power->pwrseq);
 		set_bit(QCA_BT_OFF, &qca->flags);
 		return;