Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4319-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
From: Sungwoo Kim <iam@sung-woo.kim>
To: 
Cc: daveti@purdue.edu,
	benquike@gmail.com,
	Sungwoo Kim <iam@sung-woo.kim>,
	Marcel Holtmann <marcel@holtmann.org>,
	Johan Hedberg <johan.hedberg@gmail.com>,
	Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
	linux-bluetooth@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH] Bluetooth: HCI: fix divide error in __get_blocks()
Date: Sun,  5 May 2024 22:20:36 -0400
Message-Id: <20240506022035.663102-1-iam@sung-woo.kim>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

hdev->block_len could be 0. Fix this by adding a check.

divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 9622 Comm: kworker/u5:4 Tainted: G        W          6.9.0-rc6-00001-g38e1170f515d-dirty #32
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci11 hci_tx_work
RIP: 0010:__get_blocks net/bluetooth/hci_core.c:3618 [inline]
RIP: 0010:hci_sched_acl_blk net/bluetooth/hci_core.c:3766 [inline]
RIP: 0010:hci_sched_acl net/bluetooth/hci_core.c:3806 [inline]
RIP: 0010:hci_tx_work+0x73e/0x1d10 net/bluetooth/hci_core.c:3901

Fixes: b71d385a18cd ("Bluetooth: Recalculate sched HCI blk/pkt flow ctrl")
Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
---
 net/bluetooth/hci_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 0efd59760..20b1cd7f3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3762,7 +3762,7 @@ static void hci_sched_acl_blk(struct hci_dev *hdev)
 
 	__check_timeout(hdev, cnt, type);
 
-	while (hdev->block_cnt > 0 &&
+	while (hdev->block_len > 0 && hdev->block_cnt > 0 &&
 	       (chan = hci_chan_sent(hdev, type, &quote))) {
 		u32 priority = (skb_peek(&chan->data_q))->priority;
 		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
-- 
2.34.1