Bluetooth: fix corruption in h4_recv_buf() after cleanup

A different structure is stored in drvdata for the drivers which used
that duplicate function, but h4_recv_buf() assumes drvdata is always an
hci_uart structure.

Consequently, alignment and padding are now randomly corrupted for
btmtkuart, btnxpuart, and bpa10x in h4_recv_buf(), causing erratic
breakage.

Fix this by making the hci_uart structure the explicit argument to
h4_recv_buf(). Every caller already has a reference to hci_uart, and
already obtains the hci_hdev reference through it, so this actually
eliminates a redundant pointer indirection for all existing callers.

Fixes: 93f06f8f0daf ("Bluetooth: remove duplicate h4_recv_buf() in header")
Reported-by: Francesco Valla <francesco@valla.it>
Closes: https://lore.kernel.org/lkml/6837167.ZASKD2KPVS@fedora.fritz.box/
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index b7ba667a3d09e929c05134a82ffcef86289108d5..e305d04aac9d033cedf3c098f64472ae0e6bec51 100644 (file)
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -41,6 +41,7 @@ struct bpa10x_data {
        struct usb_anchor rx_anchor;
 
        struct sk_buff *rx_skb[2];
+       struct hci_uart hu;
 };
 
 static void bpa10x_tx_complete(struct urb *urb)
@@ -96,7 +97,7 @@ static void bpa10x_rx_complete(struct urb *urb)
        if (urb->status == 0) {
                bool idx = usb_pipebulk(urb->pipe);
 
-               data->rx_skb[idx] = h4_recv_buf(hdev, data->rx_skb[idx],
+               data->rx_skb[idx] = h4_recv_buf(&data->hu, data->rx_skb[idx],
                                                urb->transfer_buffer,
                                                urb->actual_length,
                                                bpa10x_recv_pkts,
@@ -388,6 +389,7 @@ static int bpa10x_probe(struct usb_interface *intf,
        hci_set_drvdata(hdev, data);
 
        data->hdev = hdev;
+       data->hu.hdev = hdev;
 
        SET_HCIDEV_DEV(hdev, &intf->dev);
 

diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index d9b90ea2ad387c963a66984dbe3e03d82bbec2d9..27aa48ff3ac2c66fa6c638ed04a5a99af1ed707b 100644 (file)
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -79,6 +79,7 @@ struct btmtkuart_dev {
        u16     stp_dlen;
 
        const struct btmtkuart_data *data;
+       struct hci_uart hu;
 };
 
 #define btmtkuart_is_standalone(bdev)  \
@@ -368,7 +369,7 @@ static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
                sz_left -= adv;
                p_left += adv;
 
-               bdev->rx_skb = h4_recv_buf(bdev->hdev, bdev->rx_skb, p_h4,
+               bdev->rx_skb = h4_recv_buf(&bdev->hu, bdev->rx_skb, p_h4,
                                           sz_h4, mtk_recv_pkts,
                                           ARRAY_SIZE(mtk_recv_pkts));
                if (IS_ERR(bdev->rx_skb)) {
@@ -858,6 +859,7 @@ static int btmtkuart_probe(struct serdev_device *serdev)
        }
 
        bdev->hdev = hdev;
+       bdev->hu.hdev = hdev;
 
        hdev->bus = HCI_UART;
        hci_set_drvdata(hdev, bdev);

diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index d5153fed0518f5a4257feecf3e1c6c31920ffe1f..3b1e9224e9657a61851254eccf4c579c76dbe624 100644 (file)
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -212,6 +212,7 @@ struct btnxpuart_dev {
        struct ps_data psdata;
        struct btnxpuart_data *nxp_data;
        struct reset_control *pdn;
+       struct hci_uart hu;
 };
 
 #define NXP_V1_FW_REQ_PKT      0xa5
@@ -1756,7 +1757,7 @@ static size_t btnxpuart_receive_buf(struct serdev_device *serdev,
 
        ps_start_timer(nxpdev);
 
-       nxpdev->rx_skb = h4_recv_buf(nxpdev->hdev, nxpdev->rx_skb, data, count,
+       nxpdev->rx_skb = h4_recv_buf(&nxpdev->hu, nxpdev->rx_skb, data, count,
                                     nxp_recv_pkts, ARRAY_SIZE(nxp_recv_pkts));
        if (IS_ERR(nxpdev->rx_skb)) {
                int err = PTR_ERR(nxpdev->rx_skb);
@@ -1875,6 +1876,7 @@ static int nxp_serdev_probe(struct serdev_device *serdev)
        reset_control_deassert(nxpdev->pdn);
 
        nxpdev->hdev = hdev;
+       nxpdev->hu.hdev = hdev;
 
        hdev->bus = HCI_UART;
        hci_set_drvdata(hdev, nxpdev);

diff --git a/drivers/bluetooth/hci_ag6xx.c b/drivers/bluetooth/hci_ag6xx.c
index 2d40302409ffe0a411d7337c6e3aff70a3fe0cb0..94588676510f5435b4ec5181e825abd4e703711c 100644 (file)
--- a/drivers/bluetooth/hci_ag6xx.c
+++ b/drivers/bluetooth/hci_ag6xx.c
@@ -105,7 +105,7 @@ static int ag6xx_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       ag6xx->rx_skb = h4_recv_buf(hu->hdev, ag6xx->rx_skb, data, count,
+       ag6xx->rx_skb = h4_recv_buf(hu, ag6xx->rx_skb, data, count,
                                    ag6xx_recv_pkts,
                                    ARRAY_SIZE(ag6xx_recv_pkts));
        if (IS_ERR(ag6xx->rx_skb)) {

diff --git a/drivers/bluetooth/hci_aml.c b/drivers/bluetooth/hci_aml.c
index 707e90f801303341fdb74ce5aa32c7f868c59548..b1f32c5a8a3f419650b29990a684bc1435e0bb08 100644 (file)
--- a/drivers/bluetooth/hci_aml.c
+++ b/drivers/bluetooth/hci_aml.c
@@ -650,7 +650,7 @@ static int aml_recv(struct hci_uart *hu, const void *data, int count)
        struct aml_data *aml_data = hu->priv;
        int err;
 
-       aml_data->rx_skb = h4_recv_buf(hu->hdev, aml_data->rx_skb, data, count,
+       aml_data->rx_skb = h4_recv_buf(hu, aml_data->rx_skb, data, count,
                                       aml_recv_pkts,
                                       ARRAY_SIZE(aml_recv_pkts));
        if (IS_ERR(aml_data->rx_skb)) {

diff --git a/drivers/bluetooth/hci_ath.c b/drivers/bluetooth/hci_ath.c
index dbfe34664633a1c4783d359ad9b0eb5971c15430..8d2b5e7f0d6a3a08b018319cf44857cb9d3a5cb2 100644 (file)
--- a/drivers/bluetooth/hci_ath.c
+++ b/drivers/bluetooth/hci_ath.c
@@ -191,7 +191,7 @@ static int ath_recv(struct hci_uart *hu, const void *data, int count)
 {
        struct ath_struct *ath = hu->priv;
 
-       ath->rx_skb = h4_recv_buf(hu->hdev, ath->rx_skb, data, count,
+       ath->rx_skb = h4_recv_buf(hu, ath->rx_skb, data, count,
                                  ath_recv_pkts, ARRAY_SIZE(ath_recv_pkts));
        if (IS_ERR(ath->rx_skb)) {
                int err = PTR_ERR(ath->rx_skb);

diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index f96617b85d8777972137ca146ab99a3d8da12584..fff845ed44e35f26f5ddf4247d9bc80b28596ce5 100644 (file)
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -698,7 +698,7 @@ static int bcm_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       bcm->rx_skb = h4_recv_buf(hu->hdev, bcm->rx_skb, data, count,
+       bcm->rx_skb = h4_recv_buf(hu, bcm->rx_skb, data, count,
                                  bcm_recv_pkts, ARRAY_SIZE(bcm_recv_pkts));
        if (IS_ERR(bcm->rx_skb)) {
                int err = PTR_ERR(bcm->rx_skb);

diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index 9070e31a68bfd22cc31c66c53caf122a17d32f53..ec017df8572c83eac3c817e0682938facb24f883 100644 (file)
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -112,7 +112,7 @@ static int h4_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       h4->rx_skb = h4_recv_buf(hu->hdev, h4->rx_skb, data, count,
+       h4->rx_skb = h4_recv_buf(hu, h4->rx_skb, data, count,
                                 h4_recv_pkts, ARRAY_SIZE(h4_recv_pkts));
        if (IS_ERR(h4->rx_skb)) {
                int err = PTR_ERR(h4->rx_skb);
@@ -151,12 +151,12 @@ int __exit h4_deinit(void)
        return hci_uart_unregister_proto(&h4p);
 }
 
-struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
+struct sk_buff *h4_recv_buf(struct hci_uart *hu, struct sk_buff *skb,
                            const unsigned char *buffer, int count,
                            const struct h4_recv_pkt *pkts, int pkts_count)
 {
-       struct hci_uart *hu = hci_get_drvdata(hdev);
        u8 alignment = hu->alignment ? hu->alignment : 1;
+       struct hci_dev *hdev = hu->hdev;
 
        /* Check for error from previous call */
        if (IS_ERR(skb))

diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index 9b353c3d6442105074d7abe8011e084a7e3a171b..1d6e09508f1f2e93947ca2d9089b7d82519795ad 100644 (file)
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -972,7 +972,7 @@ static int intel_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       intel->rx_skb = h4_recv_buf(hu->hdev, intel->rx_skb, data, count,
+       intel->rx_skb = h4_recv_buf(hu, intel->rx_skb, data, count,
                                    intel_recv_pkts,
                                    ARRAY_SIZE(intel_recv_pkts));
        if (IS_ERR(intel->rx_skb)) {

diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c
index 7044c86325cedc571cf4df5a03ed8baab7c09c60..6f4e25917b86393f8805de36e947e767ef7a3954 100644 (file)
--- a/drivers/bluetooth/hci_ll.c
+++ b/drivers/bluetooth/hci_ll.c
@@ -429,7 +429,7 @@ static int ll_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       ll->rx_skb = h4_recv_buf(hu->hdev, ll->rx_skb, data, count,
+       ll->rx_skb = h4_recv_buf(hu, ll->rx_skb, data, count,
                                 ll_recv_pkts, ARRAY_SIZE(ll_recv_pkts));
        if (IS_ERR(ll->rx_skb)) {
                int err = PTR_ERR(ll->rx_skb);

diff --git a/drivers/bluetooth/hci_mrvl.c b/drivers/bluetooth/hci_mrvl.c
index e08222395772df184c24b539a5679ff4d3a1262e..8767522ec4c68644922a87eca1a8dd91ffbde828 100644 (file)
--- a/drivers/bluetooth/hci_mrvl.c
+++ b/drivers/bluetooth/hci_mrvl.c
@@ -264,9 +264,9 @@ static int mrvl_recv(struct hci_uart *hu, const void *data, int count)
                                !test_bit(STATE_FW_LOADED, &mrvl->flags))
                return count;
 
-       mrvl->rx_skb = h4_recv_buf(hu->hdev, mrvl->rx_skb, data, count,
-                                   mrvl_recv_pkts,
-                                   ARRAY_SIZE(mrvl_recv_pkts));
+       mrvl->rx_skb = h4_recv_buf(hu, mrvl->rx_skb, data, count,
+                                  mrvl_recv_pkts,
+                                  ARRAY_SIZE(mrvl_recv_pkts));
        if (IS_ERR(mrvl->rx_skb)) {
                int err = PTR_ERR(mrvl->rx_skb);
                bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);

diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
index cd7575c20f653f580ccb6d646061b808b6be9583..1e65b541f8ade28f65f38f6a6848f35205f7cbb4 100644 (file)
--- a/drivers/bluetooth/hci_nokia.c
+++ b/drivers/bluetooth/hci_nokia.c
@@ -624,8 +624,8 @@ static int nokia_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       btdev->rx_skb = h4_recv_buf(hu->hdev, btdev->rx_skb, data, count,
-                                 nokia_recv_pkts, ARRAY_SIZE(nokia_recv_pkts));
+       btdev->rx_skb = h4_recv_buf(hu, btdev->rx_skb, data, count,
+                                   nokia_recv_pkts, ARRAY_SIZE(nokia_recv_pkts));
        if (IS_ERR(btdev->rx_skb)) {
                err = PTR_ERR(btdev->rx_skb);
                dev_err(dev, "Frame reassembly failed (%d)", err);

diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c
index 4cff4d9be3132561ee9bae4ddf2c8ac0bc13ecd7..888176b0faa906ee3f078e75093c037e39bbd89b 100644 (file)
--- a/drivers/bluetooth/hci_qca.c
+++ b/drivers/bluetooth/hci_qca.c
@@ -1277,7 +1277,7 @@ static int qca_recv(struct hci_uart *hu, const void *data, int count)
        if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
                return -EUNATCH;
 
-       qca->rx_skb = h4_recv_buf(hu->hdev, qca->rx_skb, data, count,
+       qca->rx_skb = h4_recv_buf(hu, qca->rx_skb, data, count,
                                  qca_recv_pkts, ARRAY_SIZE(qca_recv_pkts));
        if (IS_ERR(qca->rx_skb)) {
                int err = PTR_ERR(qca->rx_skb);

diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
index cbbe79b241ce972db5b00d26ac4ceeaa424bc4ea..48ac7ca9334e5762b2c29e6db033c7895a9b2d10 100644 (file)
--- a/drivers/bluetooth/hci_uart.h
+++ b/drivers/bluetooth/hci_uart.h
@@ -162,7 +162,7 @@ struct h4_recv_pkt {
 int h4_init(void);
 int h4_deinit(void);
 
-struct sk_buff *h4_recv_buf(struct hci_dev *hdev, struct sk_buff *skb,
+struct sk_buff *h4_recv_buf(struct hci_uart *hu, struct sk_buff *skb,
                            const unsigned char *buffer, int count,
                            const struct h4_recv_pkt *pkts, int pkts_count);
 #endif