Commit 6ea83d93 authored by Jeremy Cline's avatar Jeremy Cline Committed by Greg Kroah-Hartman

Bluetooth: hci_ldisc: Initialize hci_dev before open()

commit 32a7b4cbe93b0a0ef7e63d31ca69ce54736c4412 upstream.

The hci_dev struct hdev is referenced in work queues and timers started
by open() in some protocols. This creates a race between the
initialization function and the work or timer which can result hdev
being dereferenced while it is still null.

The syzbot report contains a reliable reproducer which causes a null
pointer dereference of hdev in hci_uart_write_work() by making the
memory allocation for hdev fail.

To fix this, ensure hdev is valid from before calling a protocol's
open() until after calling a protocol's close().

Signed-off-by: default avatarJeremy Cline <>
Signed-off-by: default avatarMarcel Holtmann <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent 3df00eb8
......@@ -207,11 +207,11 @@ static void hci_uart_init_work(struct work_struct *work)
err = hci_register_dev(hu->hdev);
if (err < 0) {
BT_ERR("Can't register HCI device");
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
hdev = hu->hdev;
hu->hdev = NULL;
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
......@@ -612,6 +612,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data,
static int hci_uart_register_dev(struct hci_uart *hu)
struct hci_dev *hdev;
int err;
......@@ -655,11 +656,22 @@ static int hci_uart_register_dev(struct hci_uart *hu)
hdev->dev_type = HCI_PRIMARY;
/* Only call open() for the protocol after hdev is fully initialized as
* open() (or a timer/workqueue it starts) may attempt to reference it.
err = hu->proto->open(hu);
if (err) {
hu->hdev = NULL;
return err;
if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))
return 0;
if (hci_register_dev(hdev) < 0) {
BT_ERR("Can't register HCI device");
hu->hdev = NULL;
return -ENODEV;
......@@ -679,17 +691,12 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id)
if (!p)
err = p->open(hu);
if (err)
return err;
hu->proto = p;
set_bit(HCI_UART_PROTO_READY, &hu->flags);
err = hci_uart_register_dev(hu);
if (err) {
clear_bit(HCI_UART_PROTO_READY, &hu->flags);
return err;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment