Date:   Tue, 12 Feb 2019 00:36:49 -0800
From:   Myungho Jung <mhjungk@gmail.com>
To:     Marcel Holtmann <marcel@holtmann.org>
Cc:     Johan Hedberg <johan.hedberg@gmail.com>,
        linux-bluetooth@vger.kernel.org
Subject: [PATCH v4] Bluetooth: hci_ldisc: Add NULL check for tiocmget() and
 tiocmset()
Message-ID: <20190212083645.GA7055@myunghoj-Precision-5530>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk

tiocmget() and tiocmset() operations are optional and some tty drivers
like pty miss the operations. H4 spec requires the operations to set
flow control. Return -EOPNOTSUPP in hci_uart_tty_open() if the oprations
are not supported.

Signed-off-by: Myungho Jung <mhjungk@gmail.com>
---
Changes in v2:
  - Add NULL check and return error in ath_setup() instead of
    ath_hci_uart_work()
  - Remove braces in if statment

Changes in v3:
  - Fix to return -ENODEV
  - Split into 2 patches
  - Add stable CC and fixes tags

Changes in v4:
  - Return error in hci_uart_tty_open()

 drivers/bluetooth/hci_ldisc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index fbf7b4df23ab..3b1e433aa35b 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -474,10 +474,11 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
 	BT_DBG("tty %p", tty);
 
-	/* Error if the tty has no write op instead of leaving an exploitable
-	 * hole
+	/* Error if the tty has no write or tiocmget or tiocmset op instead of
+	 * leaving an exploitable hole
 	 */
-	if (tty->ops->write == NULL)
+	if (tty->ops->write == NULL || tty->ops->tiocmget == NULL ||
+	    tty->ops->tiocmset == NULL)
 		return -EOPNOTSUPP;
 
 	hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL);
-- 
2.17.1