Commit c884a0b2 authored by Douglas Anderson's avatar Douglas Anderson Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref



In btusb_mtk_setup(), we set `btmtk_data->isopkt_intf` to:
  usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM)

That function can return NULL in some cases. Even when it returns
NULL, though, we still go on to call btusb_mtk_claim_iso_intf().

As of commit e9087e82 ("Bluetooth: btusb: mediatek: Add locks for
usb_driver_claim_interface()"), calling btusb_mtk_claim_iso_intf()
when `btmtk_data->isopkt_intf` is NULL will cause a crash because
we'll end up passing a bad pointer to device_lock(). Prior to that
commit we'd pass the NULL pointer directly to
usb_driver_claim_interface() which would detect it and return an
error, which was handled.

Resolve the crash in btusb_mtk_claim_iso_intf() by adding a NULL check
at the start of the function. This makes the code handle a NULL
`btmtk_data->isopkt_intf` the same way it did before the problematic
commit (just with a slight change to the error message printed).

Reported-by: default avatarIncogCyberpunk <incogcyberpunk@proton.me>
Closes: http://lore.kernel.org/r/a380d061-479e-4713-bddd-1d6571ca7e86@leemhuis.info


Fixes: e9087e82 ("Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()")
Cc: stable@vger.kernel.org
Tested-by: default avatarIncogCyberpunk <incogcyberpunk@proton.me>
Signed-off-by: default avatarDouglas Anderson <dianders@chromium.org>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 79a2d467
Loading
Loading
Loading
Loading
+5 −0
Original line number Diff line number Diff line
@@ -2721,6 +2721,11 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
	if (!btmtk_data)
		return;

	if (!btmtk_data->isopkt_intf) {
		bt_dev_err(data->hdev, "Can't claim NULL iso interface");
		return;
	}

	/*
	 * The function usb_driver_claim_interface() is documented to need
	 * locks held if it's not called from a probe routine. The code here