diff options
| author | Pavel Skripkin <paskripkin@gmail.com> | 2022-03-13 18:49:36 +0100 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2022-03-18 17:12:07 +0100 |
| commit | 32cb08e958696908a9aad5e49a78d74f7e32fffb (patch) | |
| tree | 83fe50c8495919b4ad620ffe82c338cc74bdc583 /drivers/bluetooth | |
| parent | Bluetooth: Fix use after free in hci_send_acl (diff) | |
| download | linux-32cb08e958696908a9aad5e49a78d74f7e32fffb.tar.xz linux-32cb08e958696908a9aad5e49a78d74f7e32fffb.zip | |
Bluetooth: hci_uart: add missing NULL check in h5_enqueue
Syzbot hit general protection fault in __pm_runtime_resume(). The problem
was in missing NULL check.
hu->serdev can be NULL and we should not blindly pass &serdev->dev
somewhere, since it will cause GPF.
Reported-by: syzbot+b9bd12fbed3485a3e51f@syzkaller.appspotmail.com
Fixes: d9dd833cf6d2 ("Bluetooth: hci_h5: Add runtime suspend")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/hci_h5.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c index fdf504b0d265..c5a0409ef84f 100644 --- a/drivers/bluetooth/hci_h5.c +++ b/drivers/bluetooth/hci_h5.c @@ -629,9 +629,11 @@ static int h5_enqueue(struct hci_uart *hu, struct sk_buff *skb) break; } - pm_runtime_get_sync(&hu->serdev->dev); - pm_runtime_mark_last_busy(&hu->serdev->dev); - pm_runtime_put_autosuspend(&hu->serdev->dev); + if (hu->serdev) { + pm_runtime_get_sync(&hu->serdev->dev); + pm_runtime_mark_last_busy(&hu->serdev->dev); + pm_runtime_put_autosuspend(&hu->serdev->dev); + } return 0; } |