| From 59f90f1351282ea2dbd0c59098fd9bb2634e920e Mon Sep 17 00:00:00 2001 |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| Date: Mon, 3 May 2021 13:06:05 +0300 |
| Subject: Bluetooth: hci_qca: fix potential GPF |
| |
| From: Pavel Skripkin <paskripkin@gmail.com> |
| |
| commit 59f90f1351282ea2dbd0c59098fd9bb2634e920e upstream. |
| |
| In qca_power_shutdown() qcadev local variable is |
| initialized by hu->serdev.dev private data, but |
| hu->serdev can be NULL and there is a check for it. |
| |
| Since, qcadev is not used before |
| |
| if (!hu->serdev) |
| return; |
| |
| we can move its initialization after this "if" to |
| prevent GPF. |
| |
| Fixes: 5559904ccc08 ("Bluetooth: hci_qca: Add QCA Rome power off support to the qca_power_shutdown()") |
| Cc: stable@vger.kernel.org # v5.6+ |
| Cc: Rocky Liao <rjliao@codeaurora.org> |
| Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> |
| Reviewed-by: Johan Hovold <johan@kernel.org> |
| Signed-off-by: Marcel Holtmann <marcel@holtmann.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/bluetooth/hci_qca.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/drivers/bluetooth/hci_qca.c |
| +++ b/drivers/bluetooth/hci_qca.c |
| @@ -1809,8 +1809,6 @@ static void qca_power_shutdown(struct hc |
| unsigned long flags; |
| enum qca_btsoc_type soc_type = qca_soc_type(hu); |
| |
| - qcadev = serdev_device_get_drvdata(hu->serdev); |
| - |
| /* From this point we go into power off state. But serial port is |
| * still open, stop queueing the IBS data and flush all the buffered |
| * data in skb's. |
| @@ -1826,6 +1824,8 @@ static void qca_power_shutdown(struct hc |
| if (!hu->serdev) |
| return; |
| |
| + qcadev = serdev_device_get_drvdata(hu->serdev); |
| + |
| if (qca_is_wcn399x(soc_type)) { |
| host_set_baudrate(hu, 2400); |
| qca_send_power_pulse(hu, false); |
