Skip to content

[PW_SID:1043777] Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work #3265

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
BluezTestBot wants to merge 2 commits into
base: workflow
Choose a base branch
from
Open

[PW_SID:1043777] Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work #3265

BluezTestBot wants to merge 2 commits into from

Conversation

@BluezTestBot
Copy link
Owner

@BluezTestBot BluezTestBot commented Jan 18, 2026

hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling
hci_uart_register_dev(), which calls proto->open() to initialize
hu->priv. However, if a TTY write wakeup occurs during this window,
hci_uart_tx_wakeup() may schedule write_work before hu->priv is
initialized, leading to a NULL pointer dereference in
hci_uart_write_work() when proto->dequeue() accesses hu->priv.

The race condition is:

CPU0 CPU1

hci_uart_set_proto()
set_bit(HCI_UART_PROTO_INIT)
hci_uart_register_dev()
tty write wakeup
hci_uart_tty_wakeup()
hci_uart_tx_wakeup()
schedule_work(&hu->write_work)
proto->open(hu)
// initializes hu->priv
hci_uart_write_work()
hci_uart_dequeue()
proto->dequeue(hu)
// accesses hu->priv (NULL!)

Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open()
succeeds, ensuring hu->priv is initialized before any work can be
scheduled.

Fixes: 5df5daf ("Bluetooth: hci_uart: Fix another race during initialization")
Link: https://lore.kernel.org/linux-bluetooth/6969764f.170a0220.2b9fc4.35a7@mx.google.com/

Signed-off-by: Jia-Hong Su s11242586@gmail.com

drivers/bluetooth/hci_ldisc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

tedd-an and others added 2 commits January 15, 2026 16:43
@tedd-an
workflow: Add workflow files for ci
e352d45 
This patch adds workflow files for ci:

[sync.yml]
 - The workflow file for scheduled work
 - Sync the repo with upstream repo and rebase the workflow branch
 - Review the patches in the patchwork and creates the PR if needed

[ci.yml]
 - The workflow file for CI tasks
 - Run CI tests when PR is created

Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
@AxelHowe @tedd-an
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
de6af15 
hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling
hci_uart_register_dev(), which calls proto->open() to initialize
hu->priv. However, if a TTY write wakeup occurs during this window,
hci_uart_tx_wakeup() may schedule write_work before hu->priv is
initialized, leading to a NULL pointer dereference in
hci_uart_write_work() when proto->dequeue() accesses hu->priv.

The race condition is:

  CPU0                              CPU1
  ----                              ----
  hci_uart_set_proto()
    set_bit(HCI_UART_PROTO_INIT)
    hci_uart_register_dev()
                                    tty write wakeup
                                      hci_uart_tty_wakeup()
                                        hci_uart_tx_wakeup()
                                          schedule_work(&hu->write_work)
      proto->open(hu)
        // initializes hu->priv
                                    hci_uart_write_work()
                                      hci_uart_dequeue()
                                        proto->dequeue(hu)
                                          // accesses hu->priv (NULL!)

Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open()
succeeds, ensuring hu->priv is initialized before any work can be
scheduled.

Fixes: 5df5daf ("Bluetooth: hci_uart: Fix another race during initialization")
Link: https://lore.kernel.org/linux-bluetooth/6969764f.170a0220.2b9fc4.35a7@mx.google.com/

Signed-off-by: Jia-Hong Su <s11242586@gmail.com>
@github-actions
Copy link

github-actions bot commented Jan 18, 2026

CheckPatch
Desc: Run checkpatch.pl script
Duration: 0.32 seconds
Result: PENDING

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

GitLint
Desc: Run gitlint
Duration: 0.31 seconds
Result: PENDING

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

SubjectPrefix
Desc: Check subject contains "Bluetooth" prefix
Duration: 0.09 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

BuildKernel
Desc: Build Kernel for Bluetooth
Duration: 26.04 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

CheckAllWarning
Desc: Run linux kernel with all warning enabled
Duration: 27.60 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

CheckSparse
Desc: Run sparse tool with linux kernel
Duration: 31.89 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

BuildKernel32
Desc: Build 32bit Kernel for Bluetooth
Duration: 25.09 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunnerSetup
Desc: Setup kernel and bluez for test-runner
Duration: 552.87 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_l2cap-tester
Desc: Run l2cap-tester with test-runner
Duration: 28.40 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_iso-tester
Desc: Run iso-tester with test-runner
Duration: 73.56 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_bnep-tester
Desc: Run bnep-tester with test-runner
Duration: 6.26 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_mgmt-tester
Desc: Run mgmt-tester with test-runner
Duration: 116.30 seconds
Result: FAIL
Output:

Total: 494, Passed: 489 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
Read Exp Feature - Success                           Failed       0.105 seconds

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_rfcomm-tester
Desc: Run rfcomm-tester with test-runner
Duration: 9.47 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_sco-tester
Desc: Run sco-tester with test-runner
Duration: 14.45 seconds
Result: FAIL
Output:

WARNING: possible circular locking dependency detected
BUG: sleeping function called from invalid context at net/core/sock.c:3782
Total: 30, Passed: 30 (100.0%), Failed: 0, Not Run: 0

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_ioctl-tester
Desc: Run ioctl-tester with test-runner
Duration: 10.11 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_mesh-tester
Desc: Run mesh-tester with test-runner
Duration: 11.46 seconds
Result: FAIL
Output:

Total: 10, Passed: 8 (80.0%), Failed: 2, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Timed out    1.870 seconds
Mesh - Send cancel - 2                               Timed out    1.996 seconds

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_smp-tester
Desc: Run smp-tester with test-runner
Duration: 8.60 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

TestRunner_userchan-tester
Desc: Run userchan-tester with test-runner
Duration: 6.75 seconds
Result: PASS

@github-actions
Copy link

github-actions bot commented Jan 18, 2026

IncrementalBuild
Desc: Incremental build with the patches in the series
Duration: 0.46 seconds
Result: PENDING

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@BluezTestBot @tedd-an @AxelHowe