xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: hci_qca: fix potential GPF

Browse Source 
commit 59f90f1351282ea2dbd0c59098fd9bb2634e920e upstream.

In qca_power_shutdown() qcadev local variable is
initialized by hu->serdev.dev private data, but
hu->serdev can be NULL and there is a check for it.

Since, qcadev is not used before

	if (!hu->serdev)
		return;

we can move its initialization after this "if" to
prevent GPF.

Fixes: 5559904ccc ("Bluetooth: hci_qca: Add QCA Rome power off support to the qca_power_shutdown()")
Cc: stable@vger.kernel.org # v5.6+
Cc: Rocky Liao <rjliao@codeaurora.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pavel Skripkin
2021-05-03 13:06:05 +03:00
committed by Greg Kroah-Hartman
parent 904ad453ba
commit 3cdcbd1b8c
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/bluetooth/hci_qca.c
View File

@@ -1809,8 +1809,6 @@ static void qca_power_shutdown(struct hci_uart *hu)
unsigned long flags; unsigned long flags;
enum qca_btsoc_type soc_type = qca_soc_type(hu); enum qca_btsoc_type soc_type = qca_soc_type(hu);
qcadev = serdev_device_get_drvdata(hu->serdev);
/* From this point we go into power off state. But serial port is /* From this point we go into power off state. But serial port is
* still open, stop queueing the IBS data and flush all the buffered * still open, stop queueing the IBS data and flush all the buffered
* data in skb's. * data in skb's.
@@ -1826,6 +1824,8 @@ static void qca_power_shutdown(struct hci_uart *hu)
if (!hu->serdev) if (!hu->serdev)
return; return;
qcadev = serdev_device_get_drvdata(hu->serdev);
if (qca_is_wcn399x(soc_type)) { if (qca_is_wcn399x(soc_type)) {
host_set_baudrate(hu, 2400); host_set_baudrate(hu, 2400);
qca_send_power_pulse(hu, false); qca_send_power_pulse(hu, false);