From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f194.google.com (mail-pl1-f194.google.com [209.85.214.194]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A673C1AA1F4 for ; Thu, 20 Nov 2025 02:11:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.194 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763604678; cv=none; b=nnCMHkZVQLobBzoHEK2PGo+UoQ36F5uC186XpBoZaHB+XNzny7+/Zm6etg1xhBi6NNIYgQ7fC9pSeS0El/wB6dfPt0fUH5zI5wpYNJPY1wbvYi3pI9/c9u7RsainRdPvsq71kNpJeK0mU/djZPomeDnqVwiZjq/ZlFMJe3DB/W0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763604678; c=relaxed/simple; bh=m/t0JipUvu61Lp9A1bNicjXVL42+ezMKUrjSPtwtcJ8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MlN9gaDlG0MDv+fP3MFGHFCW/ssGLwDiw/mdL7NJII5/vMmND8tckfJU6+Bj7B95f3hMfAGXELazU8bfEaP8/kIm8SV0iVuaSa6BcGsjBClDuruiJVDt7npnMUTiAJQI5na4K03DexVBIl20Zzsry06L8riPbdCEOj5YQDgCFmc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=jJwm+fI1; arc=none smtp.client-ip=209.85.214.194 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="jJwm+fI1" Received: by mail-pl1-f194.google.com with SMTP id d9443c01a7336-298250d7769so2904335ad.0 for ; Wed, 19 Nov 2025 18:11:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763604674; x=1764209474; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=pTFNVmbRzXGZbT/LGhFHixBDUze2+iDNyRytGw9mv0o=; b=jJwm+fI1PkiQDnDB/vQ6inxM8wqI0wWHkWzch4Fi/aWxaFHb6NIEy2viNrIjLENQFK AJLcMysKNbvBic8zZ2Xf0ydQSWhyJFMDekgCppgA+0HY+CR4KdyVeDzyPs5LtlUW94eZ miTg07qRFp4ZBHsRns+YL7q1tvNy4PwqWtsNKYEhUFhWpybhA6vjPYUt0Bg5O6t8sKAZ Wi1UlJhCTRhTlGsjaN4XqyCgIYppKW8L/biZZmmN6bWcDpIEJTghLNFyjLATNteCked/ t7wWYiNRdPZNBEXC+w1nW0NJZZEkYs0BLswp8mLN4LEUH+63vaFq0RVSFgYsuNDWchgk itBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763604674; x=1764209474; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=pTFNVmbRzXGZbT/LGhFHixBDUze2+iDNyRytGw9mv0o=; b=sqnZ/up6CG3+EuEV0Gqd4Xre9jBsDVKjIDddWQABs74TgmHYGEK+wDxpArpFfIZnDO j6UTrh9uwLkPizjSWB2OzGAIqMP4rsCS8JkhrptTuk2rp5eIES0zHqS03CMYD4CT0p6B A5S//tVah5xthcwSKDhi8Sju1S/IHbR/h57snP67jhggcgjubSxAFxljwqVGFmnp7igX tgiwrwNPPXkxbh4M/N6gNZC2DjJi8RgbO6ehC8X/kz7E9soprHU43yN5I0CIXx/JbmXe Pdpv6QGpoyr8Ho3Jgv8wV5rK03evq7BBex3Np5TJcHAJdw/chsHR6ZuPDUu4B204vYM7 DXfQ== X-Forwarded-Encrypted: i=1; AJvYcCWX/2gtxPVxdMzUup12LfOQkfwpCw3l78iskS62qUXAJVJPprOWJlBqBcy6gEQZS77HWQdgaJmT0AYN+2c=@vger.kernel.org X-Gm-Message-State: AOJu0YzPPdJQ6d9L+0cWYuFfTEzmtmq72Timc4HdMN+Dj5b29d80gke9 jjyg56rb2L+XUM8ZKpA+PKEkrKLOcZSI6Y+I1swj7pcLdkRfHcGAvPAV X-Gm-Gg: ASbGncsYKewNLHBC63rMJY2yUF9qRMT+MysaOU1PJ8kU0/PozHPMcY7UyCcy0fo88lS 3/R6hPgGavExR7ZqkQLwdyLNQW5DlUtSk25RFS6+PhdWEZw0Ldn9wGyDc5tdgt9qgLIyAxuFfPK 7wODXykLs6M1+L9tqKbrSkr7OgY3/kkt3tqqWZiPk244gqgi9cIHFrEPL3gmJFPWy0WEF9p2pZK c5lbyJAt3173+yNVhCBfcWf2yF65i581VUwT1TtlGBySPuDZZ2PTr32yrR0KMUPN+pm6cV+BeG4 fYNYr8XWIQHMpY10CVkEfCw85zP8LWwC6kDSXHJGKpl1wdrzxkiHbJnKbrfS0xNEd1uDnISo2Cw QikDezRO0Msgt4bDnQCsbnTjoZtupIbl2DyEh8TV5fwLGIxRfwrLaWfFSkpuemY3yS1Xdq9hNzm p4ERn+1my0oN4twEEPu183Qg== X-Google-Smtp-Source: AGHT+IGJI/oKAsUQ7D64r7YwPy+QegsmPvmtzc+SJksMMBWokoHdWjKxouE6QVbTqg1qQ+RNiAulBQ== X-Received: by 2002:a17:902:f650:b0:295:54cb:16ac with SMTP id d9443c01a7336-29b5b088815mr20802785ad.18.1763604674349; Wed, 19 Nov 2025 18:11:14 -0800 (PST) Received: from Incog ([2404:7c00:42:f150:fd7c:4ceb:3809:3323]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29b5b25defasm7635325ad.49.2025.11.19.18.11.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 19 Nov 2025 18:11:13 -0800 (PST) From: Incog To: dianders@chromium.org Cc: angelogioacchino.delregno@collabora.com, incogcyberpunk@proton.me, johan.hedberg@gmail.com, linux-arm-kernel@lists.infradead.org, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mediatek@lists.infradead.org, luiz.dentz@gmail.com, marcel@holtmann.org, matthias.bgg@gmail.com, regressions@leemhuis.info, regressions@lists.linux.dev, sean.wang@mediatek.com Subject: Re: [PATCH] Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref Date: Thu, 20 Nov 2025 07:57:17 +0545 Message-ID: <20251120021217.87602-1-incogcyberpunk@gmail.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251119085354.1.I1ae7aebc967e52c7c4be7aa65fbd81736649568a@changeid> References: <20251119085354.1.I1ae7aebc967e52c7c4be7aa65fbd81736649568a@changeid> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: IncogCyberpunk On Wed, 19 Nov 2025 08:53:55 -0800 , Douglas Anderson wrote: > In btusb_mtk_setup(), we set `btmtk_data->isopkt_intf` to: > usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM) > > That function can return NULL in some cases. Even when it returns > NULL, though, we still go on to call btusb_mtk_claim_iso_intf(). > > As of commit e9087e828827 ("Bluetooth: btusb: mediatek: Add locks for > usb_driver_claim_interface()"), calling btusb_mtk_claim_iso_intf() > when `btmtk_data->isopkt_intf` is NULL will cause a crash because > we'll end up passing a bad pointer to device_lock(). Prior to that > commit we'd pass the NULL pointer directly to > usb_driver_claim_interface() which would detect it and return an > error, which was handled. > > Resolve the crash in btusb_mtk_claim_iso_intf() by adding a NULL check > at the start of the function. This makes the code handle a NULL > `btmtk_data->isopkt_intf` the same way it did before the problematic > commit (just with a slight change to the error message printed). Proposed patch: > index a722446ec73d..1466e0f1865d 100644 > --- a/drivers/bluetooth/btusb.c > +++ b/drivers/bluetooth/btusb.c > @@ -2714,6 +2714,11 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data) > struct btmtk_data *btmtk_data = hci_get_priv(data->hdev); > int err; > > + if (!btmtk_data->isopkt_intf) { > + bt_dev_err(data->hdev, "Can't claim NULL iso interface"); > + return; > + } > + > /* > * The function usb_driver_claim_interface() is documented to need > * locks held if it's not called from a probe routine. The code here I tested this patch by manually updating the drivers/bluetooth/btusb.c file with the proposed patches as above ; which solves a REGRESSION issue `bluetooth adapter provided by btusb not being recognized and hence bluetooth not working` since kernel version 6.13.2 . This REGRESSION issue has been present in both the stable and the mainline kernels since 6.13.2 release due to the below mentioned commit in v6.13.2 : Troublesome Commit Details: - Title: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() - commit id: 4194766ec8756f4f654d595ae49962acbac49490 - [ Upstream commit e9087e828827e5a5c85e124ce77503f2b81c3491 ] - Author: Douglas Anderson - Date: Wed Jan 15 19:36:36 2025 -0800 Tested-by: IncogCyberpunk Regards, IncogCyberpunk