Patch "Bluetooth: hci_intel: add missing tty-device sanity check" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

Bluetooth: hci_intel: add missing tty-device sanity check

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
bluetooth-hci_intel-add-missing-tty-device-sanity-check.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Johan Hovold <[email protected]>
Date: Wed, 29 Mar 2017 18:15:28 +0200
Subject: Bluetooth: hci_intel: add missing tty-device sanity check

From: Johan Hovold <[email protected]>

commit dcb9cfaa5ea9aa0ec08aeb92582ccfe3e4c719a9 upstream.

Make sure to check the tty-device pointer before looking up the sibling platform device to avoid dereferencing a NULL-pointer when the tty is one end of a Unix98 pty.

---
 drivers/bluetooth/hci_intel.c |   13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

@@ -307,6 +307,9 @@ static int intel_set_power(struct hci_ua
 	struct list_head *p;
 	int err = -ENODEV;
 
+	if (!hu->tty->dev)
+		return err;
+
 	mutex_lock(&intel_device_list_lock);
 
 	list_for_each(p, &intel_device_list) {

@@ -379,6 +382,9 @@ static void intel_busy_work(struct work_
 	struct intel_data *intel = container_of(work, struct intel_data,
 						busy_work);
 
+	if (!intel->hu->tty->dev)
+		return;
+
 	/* Link is busy, delay the suspend */
 	mutex_lock(&intel_device_list_lock);
 	list_for_each(p, &intel_device_list) {

@@ -913,6 +919,8 @@ done:
 	list_for_each(p, &intel_device_list) {
 		struct intel_device *dev = list_entry(p, struct intel_device,
 						      list);
+		if (!hu->tty->dev)
+			break;
 		if (hu->tty->dev->parent == dev->pdev->dev.parent) {
 			if (device_may_wakeup(&dev->pdev->dev))
 				idev = dev;

@@ -1094,6 +1102,9 @@ static int intel_enqueue(struct hci_uart
 
 	BT_DBG("hu %p skb %p", hu, skb);
 
+	if (!hu->tty->dev)
+		goto out_enqueue;
+
 	/* Be sure our controller is resumed and potential LPM transaction
 	 * completed before enqueuing any packet.
 	 */

@@ -1110,7 +1121,7 @@ static int intel_enqueue(struct hci_uart
 		}
 	}
 	mutex_unlock(&intel_device_list_lock);
-
+out_enqueue:
 	skb_queue_tail(&intel->txq, skb);
 
 	return 0;

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/usb-serial-ftdi_sio-add-device-id-for-microsemi-arrow-sf2plus-dev-kit.patch queue-4.4/bluetooth-hci_bcm-add-missing-tty-device-sanity-check.patch queue-4.4/bluetooth-hci_intel-add-missing-tty-device-sanity-check.patch queue-4.4/serial-omap-fix-runtime-pm-handling-on-unbind.patch queue-4.4/serial-omap-suspend-device-on-probe-errors.patch queue-4.4/staging-gdm724x-gdm_mux-fix-use-after-free-on-module-unload.patch