]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
Bluetooth: hci_h5: reset hci_uart::priv in the close() method
authorSergey Shtylyov <s.shtylyov@auroraos.dev>
Mon, 1 Jun 2026 20:21:30 +0000 (23:21 +0300)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Thu, 11 Jun 2026 18:24:41 +0000 (14:24 -0400)
Unlike the other HCI UART drivers, the 3-wire UART driver doesn't reset
hci_uart::priv in its close() method -- this shouldn't pose a problem as
all the methods in *struct* hci_uart_proto should only be called after the
open() method that sets up hci_uart::priv properly. However, it seems wise
to be more consistent and provide for the *struct* hci_uart_proto methods
the same state that exists before the first open() method call (so that
they rather crash than dereference a stale hci_uart::priv pointer)...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
drivers/bluetooth/hci_h5.c

index d3538371821254f7dfcef4e3f3436b5d3a535e3f..c6d9f70ad3bb00d4a43c12550be4a93d9dcc5a2a 100644 (file)
@@ -273,6 +273,7 @@ static int h5_close(struct hci_uart *hu)
        if (!hu->serdev)
                kfree(h5);
 
+       hu->priv = NULL;
        return 0;
 }