A kernel crash will happen when use tool btattach for a BT controller
with soc type QCA_ROME, and it is caused by dereferencing nullptr
hu->serdev, fixed by null check before access.
sudo btattach -B /dev/ttyUSB0 -P qca
Bluetooth: hci1: QCA setup on UART is completed
BUG: kernel NULL pointer dereference, address: 00000000000002f0
......
Workqueue: hci1 hci_power_on [bluetooth]
RIP: 0010:qca_setup+0x7c1/0xe30 [hci_uart]
......
Call Trace:
<TASK>
? show_regs+0x72/0x90
? __die+0x25/0x80
? page_fault_oops+0x154/0x4c0
? srso_alias_return_thunk+0x5/0xfbef5
? kmem_cache_alloc+0x16b/0x310
? do_user_addr_fault+0x330/0x6e0
? srso_alias_return_thunk+0x5/0xfbef5
? exc_page_fault+0x84/0x1b0
? asm_exc_page_fault+0x27/0x30
? qca_setup+0x7c1/0xe30 [hci_uart]
hci_uart_setup+0x5c/0x1a0 [hci_uart]
hci_dev_open_sync+0xee/0xca0 [bluetooth]
hci_dev_do_open+0x2a/0x70 [bluetooth]
hci_power_on+0x46/0x210 [bluetooth]
process_one_work+0x17b/0x360
worker_thread+0x307/0x430
? __pfx_worker_thread+0x10/0x10
kthread+0xf7/0x130
? __pfx_kthread+0x10/0x10
ret_from_fork+0x46/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASK>
Fixes: 03b0093f7b31 ("Bluetooth: hci_qca: get wakeup status from serdev device handle")
Signed-off-by: Zijun Hu <[email protected]>
Tested-by: Zijun Hu <[email protected]>
---
drivers/bluetooth/hci_qca.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index ecbc52eaf101..158567774cec 100644
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1957,7 +1957,7 @@ static int qca_setup(struct hci_uart *hu)
qca_debugfs_init(hdev);
hu->hdev->hw_error = qca_hw_error;
hu->hdev->cmd_timeout = qca_cmd_timeout;
- if (device_can_wakeup(hu->serdev->ctrl->dev.parent))
+ if (hu->serdev && device_can_wakeup(hu->serdev->ctrl->dev.parent))
hu->hdev->wakeup = qca_wakeup;
} else if (ret == -ENOENT) {
/* No patch/nvm-config found, run with original fw/config */
--
2.7.4
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=844120
---Test result---
Test Summary:
CheckPatch PASS 1.73 seconds
GitLint PASS 0.56 seconds
SubjectPrefix PASS 0.17 seconds
BuildKernel PASS 29.94 seconds
CheckAllWarning PASS 32.59 seconds
CheckSparse PASS 37.83 seconds
CheckSmatch FAIL 34.84 seconds
BuildKernel32 PASS 28.64 seconds
TestRunnerSetup PASS 519.51 seconds
TestRunner_l2cap-tester PASS 18.38 seconds
TestRunner_iso-tester PASS 32.85 seconds
TestRunner_bnep-tester PASS 4.64 seconds
TestRunner_mgmt-tester PASS 108.95 seconds
TestRunner_rfcomm-tester PASS 7.20 seconds
TestRunner_sco-tester PASS 14.86 seconds
TestRunner_ioctl-tester PASS 9.88 seconds
TestRunner_mesh-tester FAIL 5.85 seconds
TestRunner_smp-tester PASS 6.65 seconds
TestRunner_userchan-tester PASS 4.80 seconds
IncrementalBuild PASS 40.47 seconds
Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
Total: 10, Passed: 9 (90.0%), Failed: 1, Not Run: 0
Failed Test Cases
Mesh - Send cancel - 1 Failed 0.100 seconds
---
Regards,
Linux Bluetooth