Bluetooth: hci_qca: fix post merge window regressions

[PATCH 3/3] Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown

Posted by Bartosz Golaszewski 1 year, 6 months ago

From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Unlike qca_regulator_init(), qca_power_shutdown() may be called for
QCA_ROME which does not have qcadev->bt_power assigned. Add a
NULL-pointer check before dereferencing the struct qca_power pointer.

Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
---
 drivers/bluetooth/hci_qca.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 2baed7d0f479..45adc1560d94 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -2160,7 +2160,7 @@ static void qca_power_shutdown(struct hci_uart *hu)
 	qcadev = serdev_device_get_drvdata(hu->serdev);
 	power = qcadev->bt_power;
 
-	if (power->pwrseq) {
+	if (power && power->pwrseq) {
 		pwrseq_power_off(power->pwrseq);
 		set_bit(QCA_BT_OFF, &qca->flags);
 		return;

-- 
2.43.0

Re: [PATCH 3/3] Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown

Posted by Nícolas F. R. A. Prado 1 year, 6 months ago

On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> 
> Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> QCA_ROME which does not have qcadev->bt_power assigned. Add a
> NULL-pointer check before dereferencing the struct qca_power pointer.
> 
> Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

Hi,

I just noticed we're still hitting this issue in mainline (saw it on the
mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
bluetooth-next, but it seems there wasn't a pull request with this fix yet to
include it in 6.11. I'm wondering if it's still going to be sent.

Thanks,
Nícolas

Re: [PATCH 3/3] Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown

Posted by Bartosz Golaszewski 1 year, 6 months ago

On Wed, Aug 7, 2024 at 12:44 AM Nícolas F. R. A. Prado
<nfraprado@collabora.com> wrote:
>
> On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> >
> > Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> > QCA_ROME which does not have qcadev->bt_power assigned. Add a
> > NULL-pointer check before dereferencing the struct qca_power pointer.
> >
> > Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
>
> Hi,
>
> I just noticed we're still hitting this issue in mainline (saw it on the
> mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
> bluetooth-next, but it seems there wasn't a pull request with this fix yet to
> include it in 6.11. I'm wondering if it's still going to be sent.
>
> Thanks,
> Nícolas

The patches are in next so I don't see why they wouldn't be sent upstream.

Moving Luiz and Marcel to To: to make sure they see this message.

Bart

Re: [PATCH 3/3] Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown

Posted by Luiz Augusto von Dentz 1 year, 6 months ago

Hi Bartosz, Nicolas,

On Wed, Aug 7, 2024 at 3:53 AM Bartosz Golaszewski <brgl@bgdev.pl> wrote:
>
> On Wed, Aug 7, 2024 at 12:44 AM Nícolas F. R. A. Prado
> <nfraprado@collabora.com> wrote:
> >
> > On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> > > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > >
> > > Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> > > QCA_ROME which does not have qcadev->bt_power assigned. Add a
> > > NULL-pointer check before dereferencing the struct qca_power pointer.
> > >
> > > Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> > > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > > Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> > > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> >
> > Hi,
> >
> > I just noticed we're still hitting this issue in mainline (saw it on the
> > mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
> > bluetooth-next, but it seems there wasn't a pull request with this fix yet to
> > include it in 6.11. I'm wondering if it's still going to be sent.
> >
> > Thanks,
> > Nícolas
>
> The patches are in next so I don't see why they wouldn't be sent upstream.
>
> Moving Luiz and Marcel to To: to make sure they see this message.

I was on a business trip last week, will prepare the pull request later today.

-- 
Luiz Augusto von Dentz

Re: [PATCH 3/3] Bluetooth: hci_qca: fix a NULL-pointer derefence at shutdown

Posted by Nícolas F. R. A. Prado 1 year, 6 months ago

On Wed, Aug 07, 2024 at 11:03:09AM -0400, Luiz Augusto von Dentz wrote:
> Hi Bartosz, Nicolas,
> 
> On Wed, Aug 7, 2024 at 3:53 AM Bartosz Golaszewski <brgl@bgdev.pl> wrote:
> >
> > On Wed, Aug 7, 2024 at 12:44 AM Nícolas F. R. A. Prado
> > <nfraprado@collabora.com> wrote:
> > >
> > > On Wed, Jul 31, 2024 at 05:20:50PM +0200, Bartosz Golaszewski wrote:
> > > > From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > > >
> > > > Unlike qca_regulator_init(), qca_power_shutdown() may be called for
> > > > QCA_ROME which does not have qcadev->bt_power assigned. Add a
> > > > NULL-pointer check before dereferencing the struct qca_power pointer.
> > > >
> > > > Fixes: eba1718717b0 ("Bluetooth: hci_qca: make pwrseq calls the default if available")
> > > > Reported-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> > > > Closes: https://lore.kernel.org/linux-bluetooth/su3wp6s44hrxf4ijvsdfzbvv4unu4ycb7kkvwbx6ltdafkldir@4g7ydqm2ap5j/
> > > > Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
> > >
> > > Hi,
> > >
> > > I just noticed we're still hitting this issue in mainline (saw it on the
> > > mt8183-juniper platform in KernelCI). I see this commit was merged 6 days ago to
> > > bluetooth-next, but it seems there wasn't a pull request with this fix yet to
> > > include it in 6.11. I'm wondering if it's still going to be sent.
> > >
> > > Thanks,
> > > Nícolas
> >
> > The patches are in next so I don't see why they wouldn't be sent upstream.
> >
> > Moving Luiz and Marcel to To: to make sure they see this message.
> 
> I was on a business trip last week, will prepare the pull request later today.

Sounds good. And sorry for bothering you about this, I just wanted to make sure
the fix was headed to 6.11.

Thanks,
Nícolas